Insider Threat Consultant

MassMutual•Springfield, MA

1d•Hybrid

About The Position

MassMutual is advancing an enterprise Insider Threat program focused on identifying and managing human-driven cyber risk. The Insider Threat Consultant will play a key role in developing the asset intelligence, monitoring strategies, detection capabilities, and investigative processes necessary to identify and manage insider-driven risk. This role combines deep technical expertise, critical asset analysis, behavioral risk assessment, and investigative discipline to understand how people interact with sensitive assets and to identify patterns of activity that may indicate elevated risk. The consultant will partner with cybersecurity operations, detection engineering, HR, Legal, Privacy, and business stakeholders to align monitoring and investigative capabilities with asset sensitivity and business impact. This position is suited for an experienced practitioner who can operate across technical, analytical, and investigative domains while helping build and mature an enterprise-scale insider threat program.

Requirements

8+ years of experience in cybersecurity, insider threat, investigations, intelligence analysis, data protection, enterprise architecture, or related disciplines.
2+ years of experience working cross-functionally with security, HR, Legal, Privacy, business, or investigative stakeholders.

Nice To Haves

Experience supporting or building an Insider Threat Program.
Experience supporting Critical Asset Protection, Information Protection, Data Protection, or Human Risk Management initiatives.
Experience conducting cyber, digital, fraud, employee misconduct, or insider threat investigations.
Experience analyzing logs, endpoint telemetry, identity activity, access patterns, and behavioral signals.
Hands-on experience contributing to detection use cases, monitoring strategies, investigative workflows, or security content development.
Experience identifying, classifying, mapping, or protecting sensitive information or critical assets.
Strong understanding of identity and access management concepts, privileged access, trust relationships, and access governance.
Experience with SIEM, EDR, UEBA, DLP, insider risk management, identity security, and security analytics platforms.
Experience developing, tuning, or validating detection logic across endpoint, identity, network, and data protection technologies.
Experience analyzing user behavior and identifying anomalous or high-risk activity through the correlation of multiple data sources.
Familiarity with deception technologies, cyber deception strategies, or adversary engagement techniques.
Experience supporting highly regulated environments such as financial services.
Professional certifications such as CISSP, CISM, GIAC, CDLP, GCFA, GCIH, or equivalent.
Degree in cybersecurity, intelligence studies, psychology, criminal justice, information systems, or related field.

Responsibilities

Identify and prioritize critical assets requiring enhanced monitoring and protection.
Analyze how critical assets are accessed, used, and shared across the enterprise.
Map relationships between identities, access privileges, business processes, and critical assets.
Analyze behavioral and technical indicators associated with insider risk.
Identify patterns of activity that may indicate misuse or mishandling of critical assets.
Conduct and support complex insider threat investigations.
Correlate identity, access, asset, and behavioral signals across multiple data sources.
Monitor and analyze deception environments and adversary interaction signals.
Partner with detection engineering and security operations to develop and refine insider threat detection logic.
Contribute to tuning enterprise security tooling to improve identification of insider-driven risk.
Support development of early-warning frameworks and proactive risk identification.
Produce clear, defensible analytical findings and case documentation.
Support executive reporting and enterprise risk visibility.