Cybersecurity Analyst - Insider Risk

KLA•Ann Arbor, MI

1d•Onsite

About The Position

The Cybersecurity group at KLA is involved in every aspect of the global business. The KLA Cybersecurity group defends against cyber-attacks and provides cybersecurity tools, incident response services and assessment capabilities to safeguard the environments that support the essential operations of KLA. We are passionate about identifying adversarial activities and anticipating a wide variety of threats to strengthen our defenses and the overall protection of KLA Intellectual Property. We are seeking a qualified Insider Risk Analyst to join our Digital Information Risk team. In this role, you will monitor potential threats and analyze risky activity. Come join our team in this critical role to protect KLA!

Requirements

Experience with insider risk or similar role monitoring for digital risks such as abuse, fraud, intellectual property theft
Demonstrated experience with UEBA/UBA, DLP, EDR, and SIEM tools
Effective communication, interpersonal skills, and ability to work with partners across the business
Self-sufficient, motivated individual with the ability to calmly operate in high stress environment to meet goals in a timely manner
Proficiency in Microsoft Office suite to analyze data, collaborate with peers, and communicate findings
Bachelor's Level Degree and related work experience of 2 years

Nice To Haves

Cybersecurity certifications such as Certification in Certified Information Systems Security Professional (CISSP) or Certified Ethical Hacker (CEH)
Experience with data analytics tools to identify trends and correlate data sources
Experience with SQL or Python
Experience in developing detection rules and alerts
Ability to read, speak, and write in a foreign language where KLA conducts business

Responsibilities

Conduct in-depth analysis and investigation into alerts and relevant logs to identify, analyze, document, and report on actions or behaviors that are risky, are noncompliant to company policies, or are identified as anomalous.
Triage complex alerts, correlating data sources across SIEM, EDR, and DLP tooling to assess overall business risk across a wide range of IT systems and environments.
Align standard operating procedures with relevant incident response plans, providing clear and detailed information to help address the perceived risk.
Collaborate across the enterprise to support investigations processes and communicate business risks, including opportunities to strengthen security posture.
Conduct root cause analyses to drive corrective actions and mitigation after case closure.
Continually adapt and learn from findings to what is and is not risky behavior based on prior notifications, changes in policies, and changes in security logs.