Detect and analyze insider threat activity in an enterprise environment by monitoring alerts, triaging incidents, and correlating data across multiple security tools. This role is for security analysts who thrive in structured programs and can balance investigative rigor with privacy and civil liberties compliance.
What you'll do
- Monitor and analyze logs and alerts from multiple enterprise applications (SIEM, DLP, UEBA tools) via dashboards to distinguish genuine insider threat incidents from false positives
- Triage and investigate potential insider threat indicators, escalating confirmed or ambiguous cases to senior analysts
- Support configuration, tuning, and troubleshooting of detection tool triggers and enterprise insider threat systems
- Correlate data across multiple sources to build complete pictures of potential insider threat activity
- Document findings, produce analytical write-ups, and maintain case records per established procedures
- Assist with deployment, operation, and maintenance of enterprise security tools
- Coordinate with SOC, investigative teams, and other stakeholders while ensuring all activities comply with federal insider threat guidelines and privacy/civil liberties requirements
Mission
This position supports a federal Insider Threat Program Detection and Prevention (ITPDP) effort focused on protecting the nation's vital interests. Working within an established program with clear procedures, you'll operate in a DoD or federal civilian environment where insider threat mitigation is critical to national security.
Required skills
- Insider threat detection and analysis
- SIEM tools (Splunk, Exabeam)
- DLP tools (Proofpoint, ObserveIT)
- UEBA/UAM tools (DTEX)
- Log analysis and event correlation
- Windows, Unix, Linux environments
- Digital forensics concepts
- Enterprise security tools configuration
- Incident triage and investigation
- Security documentation and reporting