Insider Threat Analyst

MartinFed • Washington, DC

1d • Onsite

About The Position

The Insider Threat Analyst supports the Insider Threat Program Detection and Prevention (ITPDP) by performing day-to-day monitoring, detection, analysis, and triage of potential insider threat activity across enterprise environments. This role analyzes alerts and user activity from multiple security platforms to distinguish legitimate insider threat incidents from false positives, documents findings, and escalates cases as appropriate. Working under the direction of the Senior Insider Threat Analyst, the analyst supports the operation and continuous improvement of the insider threat program while ensuring all activities comply with federal insider threat policies, employee privacy protections, and civil liberties requirements.

Requirements

• U.S. Citizen with the ability to obtain and maintain a Tier 5 security clearance or higher.
• Bachelor's degree in Cybersecurity, Information Technology, Criminal Justice, Intelligence Studies, or a related field (additional relevant experience may be substituted for education).
• Approximately 6 years of combined experience in cybersecurity, security operations, investigations, digital forensics, insider threat, or related disciplines.
• Hands-on experience with one or more enterprise Insider Threat, DLP, SIEM, UEBA, or User Activity Monitoring (UAM) platforms such as Splunk, DTEX, Microsoft Purview, Proofpoint/ObserveIT, Exabeam, or similar technologies.
• Experience analyzing logs, alerts, dashboards, and user activity to differentiate true security incidents from false positives.
• Working knowledge of Windows, Linux, and Unix operating systems.
• Understanding of insider threat methodologies, user behavior analytics, event correlation, and investigative techniques.
• Familiarity with digital forensics concepts, log analysis, and security investigations.
• Knowledge of privacy, legal, and civil liberties considerations associated with federal Insider Threat Programs.
• Excellent analytical, documentation, and written communication skills.
• Ability to work effectively within an established insider threat program under the guidance of senior analysts.
• Ability to obtain the Counter-Insider Threat Fundamentals Certification, if required.

Nice To Haves

• Experience supporting formal Federal Insider Threat Programs.
• Experience with SIEM, UEBA, UAM, DLP, and behavioral analytics platforms.
• Familiarity with Splunk Enterprise Security, Microsoft Purview, DTEX, Exabeam, Proofpoint/ObserveIT, or similar solutions.
• Experience correlating events across multiple enterprise security tools.
• Knowledge of security operations center (SOC) workflows and incident response processes.
• Understanding of insider threat indicators, behavioral analytics, and risk scoring methodologies.
• Experience developing or improving detection rules, workflows, and investigative playbooks.
• Basic scripting experience (PowerShell, Python, or Bash) for automation or analysis.
• Familiarity with NIST, CNSSD, or other federal insider threat guidance and best practices.
• Strong collaboration skills when working with cybersecurity, investigative, legal, and human resources stakeholders.

Responsibilities

• Monitor logs, dashboards, and alerts across multiple enterprise security applications to identify potential insider threat activity.
• Analyze user activity and system events to distinguish legitimate insider threat incidents from false positives.
• Continuously monitor enterprise environments for indicators of malicious, negligent, or compromised insider behavior.
• Perform initial triage and investigation of potential insider threat alerts.
• Correlate information from multiple data sources to develop a complete understanding of potential insider threat activity.
• Escalate confirmed or ambiguous incidents to the Senior Insider Threat Analyst in accordance with established procedures.
• Maintain complete case documentation throughout the investigative lifecycle.
• Assist with configuring, tuning, and troubleshooting detection rules, triggers, and analytics used by insider threat platforms.
• Support the deployment, maintenance, and day-to-day operation of enterprise insider threat detection technologies.
• Help improve detection fidelity by reducing false positives and refining alert logic.
• Document investigative findings through clear analytical reports and case summaries.
• Maintain accurate records in accordance with program reporting requirements.
• Assist in developing workflows, playbooks, standard operating procedures, and other program documentation.
• Coordinate with Security Operations Center (SOC), investigative teams, Human Resources, Legal, and other stakeholders as directed.
• Support continuous improvement initiatives for the Insider Threat Program.
• Conduct all investigative activities in accordance with federal insider threat guidance while protecting employee privacy and civil liberties.

Benefits

• Customer-focused, performance-based solutions using technology and an empowered workforce as an engine to drive its customers' missions.
• Attract the best and brightest within their field.
• Invest in our people because they are our greatest asset.
• Cultivate our purpose, embody and reflect our core values, and define our culture.
• Be Driven - We are fueled by the hunger to learn more and do more.
• Be Curious - We engage in continuous improvement - never accepting the status quo.
• Be Humble - We seek honest feedback to strengthen our relationships.
• Pursue Excellence - We strive to achieve extraordinary results and do not settle for mediocrity.
• Strive for excellence and consider joining our growing team today!

What This Job Offers

• Job Type: Full-time
• Career Level: Senior