Insider Threat Detection Engineer

NVIDIA•Redmond, WA

2d•$168,000 - $310,500

About The Position

NVIDIA is hiring an Insider Threat Engineer to help protect its people, intellectual property, engineering systems, and data, including source code, hardware and software designs, AI models and artifacts, research, build systems, and computing environments. The role combines security engineering with insider-threat investigations across identity, endpoint, cloud, collaboration, source-code, and data-protection systems. It involves building detections, automation, integrations, and investigation tools, and using them to examine activity that may put NVIDIA at risk. The engineer will translate technical and business information into clear timelines and findings, work closely with Security, Legal, HR, Privacy, IT, and engineering teams, and handle sensitive information carefully while distinguishing facts from assumptions. The role develops and operates capabilities for identifying and investigating insider threats. It includes building and tuning detections, leading or supporting investigations, correlating evidence from multiple sources, developing automation and investigation tools, improving insider-risk and data loss prevention capabilities, and presenting findings with confidence levels, limitations, alternative explanations, and unanswered questions. The engineer will also work with authorized partners on evidence preservation, containment, escalation, and remediation while complying with requirements for investigative scope, access, confidentiality, auditing, and retention.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Data Engineering, or a related field, or equivalent experience.
At least 7 years of experience in insider threat, detection engineering, security operations, incident response, digital forensics, data protection, threat hunting, or a related security field.
Experience conducting security investigations, including defining scope, collecting evidence, developing timelines, analyzing activity, documenting findings, escalating concerns, and applying lessons learned.
Experience with security technologies such as SIEM, DLP, UEBA, EDR, insider-risk management, identity security, case management, or security orchestration.
Proficiency in at least one programming or scripting language, such as Python, Go, Java, JavaScript, or TypeScript, and experience building automation with APIs, structured data, source control, and testing.
SQL, security-query, and data-analysis skills, including experience correlating incomplete or inconsistent data from multiple sources.
Knowledge of identity and access management, endpoints, cloud services, collaboration platforms, SaaS integrations, data classification, source-code environments, and data-exfiltration methods.
Experience translating insider-risk scenarios into telemetry requirements, detection logic, investigation workflows, controls, test cases, and performance measures.
Ability to assess activity objectively, distinguish indicators from substantiated findings, avoid assumptions about intent, and explain the limits of available evidence.
Clear written and verbal communication skills and experience working with technical, legal, privacy, HR, and business partners on sensitive matters.

Nice To Haves

Experience engineering insider-risk, data loss prevention, or endpoint data-protection capabilities and connecting their signals to SIEM, orchestration, enrichment, or case-management systems.
Experience investigating data movement across email, cloud storage, collaboration tools, source-code repositories, build systems, artifact stores, removable media, browsers, AI tools, and unmanaged or partially managed environments.
Experience building security data pipelines, entity timelines, relationship models, behavioral baselines, or applications used by investigators.
Knowledge of digital forensics, evidence preservation, chain of custody, incident-response coordination, and the legal, privacy, and employee-relations requirements associated with workforce investigations.
Experience turning investigation needs into technical capabilities; senior candidates may also have experience leading projects, reviewing designs, and mentoring engineers or investigators.

Responsibilities

Build, test, deploy, and tune detections across identity, endpoint, cloud, SaaS, collaboration platforms, source-code repositories, build systems, removable media, data movement, and employee-lifecycle signals.
Lead and support investigations involving unusual data movement, unapproved application use, external sharing, access anomalies, compromised accounts, employee transitions, and other defined insider-risk scenarios.
Collect and correlate information from endpoint, identity, cloud, source-code, collaboration, data-protection, and approved business sources to reconstruct activity and establish timelines.
Develop automation, data pipelines, integrations, dashboards, and investigation tools to reduce manual work and improve the consistency and efficiency of investigations.
Operate and improve insider-risk and data loss prevention capabilities by assessing policy performance, detection coverage, alert quality, false positives, and connections to case-management workflows.
Improve detections using documented hypotheses, threat models, test cases, version control, peer review, and performance measures; work with system owners to address telemetry or control gaps.
Present findings to Security, Incident Response, Legal, HR, Privacy, and business partners, distinguishing facts from inferences and explaining confidence levels, data limitations, alternative explanations, and unanswered questions.
Work with authorized partners on evidence preservation, containment, escalation, and remediation while following requirements for investigative scope, access, confidentiality, auditing, and retention.