The Insider Risk Security Engineer joins the Information Security Insider Risk team to protect data from risks associated with individuals who have authorized access. In this role, you will manage insider risk capabilities by driving tooling requirements to identify anomalous user activities and indicators while providing support during active incidents. You will implement and maintain Insider Risk Management technologies, fine-tune DLP rules to minimize false positives, and collaborate with IT, HR, and Legal teams to refine security policies. The position requires expertise in cloud security, UEBA tools, and Microsoft E5 products. Technical skills include KQL, YARA, Regex, JSON, and Lucene Query Syntax. You will address critical business problems such as nation-state threats, negligent employee activity, and malicious insider behavior within a global semiconductor environment to enhance the overall security posture of the organization.
Implement, maintain, and troubleshoot Insider Risk Management (IRM) technologies and policies across the organization.
Define and refine security policies in coordination with IT, HR, and Legal teams.
Fine-tune IRM and Data Loss Prevention (DLP) rules to minimize false positives.
Develop innovative use cases to detect anomalous user activities and identify security trends.
Serve as a technical expert and escalation point for insider risk inquiries.
Provide data-driven insights into the performance and effectiveness of the IRM ecosystem for management reporting.
Monitor and mitigate risks from nation-state actors, negligent employees, and malicious internal activity.
What we're looking for
Bachelor's degree in Computer Science, Cybersecurity, Information Security, Information Technology, Counterintelligence, or a related discipline.
5+ years of experience as a security engineer familiar with typical DLP and UEBA tools.
Proven experience implementing, troubleshooting, and administering Insider Risk and DLP technologies in a global enterprise.
Experience with cloud security and cloud-based applications.
Excellent problem-solving skills and the ability to work independently.
Outstanding communication skills for effective collaboration across different teams and stakeholders.
Certifications in cybersecurity such as CISSP, CISM, or CEH (preferred).
Formal education/training in insider risk or counterintelligence; knowledge of Microsoft E5 products, UEBA tools, KQL, YARA, Regex, JSON, Lucene, behavioral analysis, or semiconductor industry experience (preferred).