Cyber Behavioral Defense Lead

Wells Fargo•McLean, VA

3d•$119,000 - $224,000•Hybrid

About The Position

Wells Fargo is seeking a Cyber Behavioral Defense Lead (Lead Information Security Analyst), as part of the Technology Management and Strategy team. You will serve as the lead for Behavioral Defense within the Cyber Resiliency & Human Defense Team and will examine how threat actors exploit human judgment, trusted relationships, business processes, communication channels, and operational routines. You will translate those insights into targeted interventions that reduce human-enabled cyber risk. Interventions may include changes to business processes, controls, decision points, communications, campaigns, employee guidance, or targeted learning.

Requirements

5+ years of Information Security Analysis experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education

Nice To Haves

Demonstrated experience in information security, cyber risk, threat intelligence, fraud prevention, identity-related risk, insider threat, or adversary-focused security disciplines
Experience conducting red team exercises, adversary emulation, or offensive security assessments
Experience designing, leading, or evaluating social engineering assessments and adversary simulation activities
Demonstrated experience managing fraud, identity-related risks, account compromise, or trust and safety concerns
Proven ability to translate complex cyber threats and security risks into practical business actions and risk mitigation strategies
Experience leading complex, cross-functional security initiatives across business, technology, and risk management teams
Experience developing executive-level findings, briefings, and strategic recommendations for senior leadership
Experience identifying and assessing how threat actors exploit authority, urgency, trust, routine, fear, helpfulness, and other human decision-making behaviors
Experience reviewing business processes, workflows, and control environments to identify vulnerabilities related to fraud, social engineering, insider misuse, or unauthorized disclosure of information
Working knowledge of phishing, vishing, smishing, deepfakes, business email compromise (BEC), impersonation attacks, trusted-access abuse, and AI-enabled social engineering techniques

Responsibilities

Provide advanced information security consultation for all aspects of information security compliance policy, risk management, and remediation
Directly assess risk, develop intervention strategies, create campaign briefs and priority content, coordinate delivery and evaluate whether the intervention changed behavior or reduced exposure
Analyze threat intelligence, insider threat insights, incidents, simulation results, and business processes to identify where attackers can exploit human judgment, trusted relationships, operational routines, or control gaps
Identify high-risk populations, processes, and decision points, then define the behavior or process change needed to reduce exposure
Partner closely with Cyber Threat Intelligence, Insider Threat, simulation teams, and business-process owners to convert threat insights into practical interventions
Determine whether risk should be addressed through a process or control change, targeted campaign, behavioral nudge, decision aid, role-based guidance, learning experience, or a combination of action
Create and own behavioral-risk assessments, intervention strategies, campaign briefs, messaging architecture, process-change recommendations, and priority content
Design threat-informed campaigns that help employees recognize manipulation, verify unusual requests, escalate concerns, and make safer decisions under pressure
Translate complex cyber threats into clear, relevant, and actionable guidance for employees, leaders, high-risk populations, and business partners
Define the intended behavioral or process outcome before launch and partner with measurement teams to establish baselines, target populations and success measures
Evaluate results and recommend whether interventions should continue, change, expand, be reinforced, or stop
Serve as the Behavioral Defense individual contributor under the Head of Behavioral Defense & Human Risk, influencing cybersecurity, fraud, control, technology, and business partners without direct reporting authority