Security Engineer, Insider Threat

📋 Description

• Develop insider threat detections using log analytics and behavior data.
• Monitor data exfiltration, privilege misuse, and unusual user behavior.
• Leverage SIEM (Splunk), endpoint telemetry (SentinelOne), and Purview.
• Build detection logic for USB transfers, cloud uploads, mass file access.
• Support risk scoring models and analytics refinements.
• Conduct insider threat investigations using endpoint, identity, cloud, and collaboration telemetry.

🎯 Requirements

• 2+ years in information security investigations, incident response, or SOC.
• Experience with SIEM platforms (Splunk preferred).
• Experience interpreting endpoint telemetry (SentinelOne preferred).
• Experience with data governance or data loss prevention tools (Purview preferred).
• Strong understanding of Windows, macOS, and enterprise auth systems.
• Experience examining data exfiltration, privilege misuse, or compromise.
• Ability to write and tune log queries for investigations.
• Strong analytical and documentation skills.

🎁 Benefits

• Paid time off
• Retirement savings plans (401k, pension)
• Bonus or incentive eligibility
• Equity grants
• Employee stock purchase plan
• Competitive health benefits
• Parental leave