UEBA Engineer - Identity, Security and Insider Risk

About the role

Booz Allen is looking for an Enterprise Cybersecurity User and Entity Behavior Analytics (UEBA) Engineer in McLean. The role strengthens identity, security and insider risk programs by improving visibility into user and entity behavior, supporting detection, investigation and response to anomalous activity, account compromise and insider risk. It involves analyzing user, device, application, network, cloud and security telemetry to find deviations from expected behavior, and works closely with cyber operators, threat analysts, incident responders, data scientists and AI engineers.

U.S. citizenship is required because of the nature of the work in this facility.

Key responsibilities

• Develop, tune and maintain UEBA detections, behavioral baselines, anomaly detection rules and risk-based analytics across users, devices, applications and cloud entities.
• Deploy, configure and maintain UEBA software.
• Work with cyber operators, threat analysts, incident responders and security stakeholders to define requirements, validate detections and integrate UEBA analytics into SOC workflows.
• Build dashboards, reports and risk indicators that convey behavioral trends, high-risk activity and investigation findings to technical and executive audiences.
• Improve detection logic by evaluating alert quality, reducing false positives and incorporating analyst feedback and lessons learned from incidents.

Required profile

• 3+ years of experience in cybersecurity analytics, security operations, threat detection, threat hunting, insider risk or UEBA.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science or Data Analytics, or 5+ years of experience in those fields instead.
• Ability to document analytical methods, findings, detection logic and recommended actions clearly, and to work independently and in teams.
• Self-motivated, detail-oriented and able to manage multiple priorities.

Required skills

• 1+ year with a UEBA tool such as EverFox, CrowdStrike or Splunk.
• Experience developing, tuning and operationalizing behavioral analytics, anomaly detection rules, risk scores or correlation logic.
• Experience with SIEM, UEBA, EDR, identity or cybersecurity platforms.
• Nice to have: insider threat, DLP, fraud detection, account takeover or privileged-user monitoring experience, and strong communication skills.

What we offer

• Health, life, disability, financial and retirement benefits, paid leave and professional development.
• Tuition assistance, work-life programs and dependent care support.
• A recognition awards program for exceptional performance.
• Projected annual salary range of $69,400 to $158,000 depending on location, qualifications and experience.