Senior Security Engineer, Insider Threat Detection & Response

About the role

We are seeking a Senior Security Engineer to help build and mature an insider threat detection and response program from the ground up. You will join a front‑line security team that detects, investigates, and responds to threats against company data, systems, and infrastructure. In this role, you will shape detection capabilities through hands‑on technical work and cross‑functional influence, with direct impact on how the organization protects its most sensitive information.

Key responsibilities

• Identify visibility gaps across infrastructure and partner with business teams to close them through improved logging and detection.
• Design and write detections for data misuse and data exfiltration at scale.
• Build automation and detection models that surface anomalous activity and speed up response.
• Proactively hunt for insider threats across corporate and production environments.
• Partner with engineering teams to develop advanced detection solutions, and work closely with Human Resources and Legal on complex investigations.
• Recommend and help design countermeasures that reduce insider risk.
• Take part in incident response and provide subject‑matter expertise during insider threat incidents.
• Participate in an on‑call rotation that supports 24/7 detection and response coverage.
• Contribute to security awareness messaging and training.

Required profile

• 5+ years of hands‑on experience in security operations, such as detection engineering, threat hunting, incident response, digital forensics, or threat intelligence.
• Bachelor’s degree in a related technical field, or equivalent practical experience.
• Experience with insider threat technologies, such as Data Loss Prevention (DLP) and User and Entity Behavior Analytics (UEBA).
• Exposure to data science and analytics approaches that apply to insider threat detection.
• Experience automating security detection and response.
• Solid understanding of how insider threat and incident response connect, including how to coordinate responses to insider incidents.
• Working knowledge of insider threat challenges at consumer‑facing companies.
• Familiarity with the Cyber Kill Chain and MITRE ATT&CK frameworks and how they apply to insider threats.
• Self‑motivated, creative problem‑solver who works well independently.
• Stays calm and collaborative under pressure in time‑sensitive situations.
• Strong organization, prioritization, and multitasking skills.

Required skills

• Python
• SQL
• AWS
• Data Loss Prevention (DLP)
• User and Entity Behavior Analytics (UEBA)