Lead Security Monitoring and Response Analyst (Insider Threat Program Lead)

What you'll do

• Set Insider Threat investigation standards and guide subject matter experts on complex, high-risk cases.
• Build Insider Threat detection strategies, controls, and countermeasures aligned to emerging tactics and techniques.
• Drive the maturity of DLP, UAM, and UBA capabilities in partnership with technology owners.
• Maintain Insider Threat policies, operating standards, and accurate program documentation.
• Serve as the primary liaison for Technology, Security, HR, Legal, Privacy, and Compliance partners.
• Assess capability risks, identify control gaps, and define remediation plans to strengthen long-term resilience.
• Design exercises to test and strengthen the organization's Insider Threat capabilities.
• Lead the Insider Threat Working Group and escalate priorities to the Steering Committee.

What we're looking for

• Extensive experience in security operations, incident response, insider risk, digital forensics, or related cybersecurity disciplines.
• Demonstrated ability to conduct and oversee sensitive, confidential investigations involving employee activity while maintaining privacy and evidentiary integrity.
• Experience developing, enhancing, or governing Insider Threat, DLP, UAM, UBA, or related security capabilities.
• Experience with Microsoft security technologies including Microsoft Purview, Microsoft Defender / IRM, Microsoft Sentinel, and Endpoint DLP.
• Experience with Security Information and Event Management (SIEM) platforms and security event analysis.
• Working knowledge of Windows and macOS operating systems, including key architectural and investigative differences.
• Familiarity with threat hunting methodologies, open-source intelligence (OSINT), and cyber investigation techniques.
• Relevant industry certifications such as CISSP, GCIH, GCIA, Security+, or equivalent (preferred).