Insider Threat Support Analyst

Evolver Federal•Camp Springs, MD

1d•$120,000 - $130,000•Onsite

About The Position

Evolver is seeking a talented and motivated Insider Threat Support Analyst to join our team onsite in Camp Springs, MD. The ideal candidate will have a strong background in cybersecurity and risk management, serving as a critical member of the Cyber Intelligence Operations program's dedicated insider-risk element (InT). As an Insider Threat Support Analyst, you will focus on identifying, assessing, and mitigating risks posed by trusted individuals including employees, contractors, and partners who may intentionally or unintentionally harm organizational systems, data, or personnel. Operating as a highly motivated self-starter within a lean, agile team, you must possess the technical drive and critical thinking needed to execute complex investigations and refine detection strategies with minimal oversight. Emphasizing departing-employee and high-risk user scenarios, you will leverage telemetry from DLP, SIEM (Splunk), EDR/NDR, cloud storage, email, VPN/web, UAM (Teramind), and IAM logs. You will maintain prioritized insider use-case catalogs, apply defensible risk scoring, and collaborate with cross-functional teams to define requirements for automation-first playbooks, all while ensuring strict alignment with policy, privacy, civil liberties, and inspection requirements.

Requirements

Must possess and maintain at least one active certification: Security+ or ISC2 CISSP (or other comparable certification approved in advance by the SOC PM).
Bachelor's degree in Computer Science, Information Security, or a related field, OR a minimum of two (2) years of dedicated experience in insider threat detection, APT mitigation, and User Activity Monitoring (e.g., Teramind).
2+ years of experience with SPLUNK architecture (indexer, forwarder, search heads, etc.), including UI/GUI development and operational roles. Familiarity with DLP, EDR/NDR, and IAM logging.
Must be a U.S. Citizen with an active Top Secret Clearance.
Must meet SCI eligibility (ICD 704) with no waivers or conditions.

Nice To Haves

Proven track record as a self-starter with a demonstrated ability to establish task priorities, manage workflows, and deliver high-quality analytical products with minimal supervision.
Experience working effectively in small, fast-paced team environments where cross-training, adaptability, and direct communication are critical.
3+ years of experience with SPLUNK architecture, UI/GUI development, and automation-first SOAR integrations.
3+ years of specific experience in insider threat detection, behavioral analytics, and mitigation techniques.
Strong analytical and problem-solving skills, with the ability to dissect complex security incidents, assign defensible risk scores, and communicate findings effectively to technical and non-technical stakeholders.
Proven ability to develop tactical metrics, monthly trend summaries, and strategic intelligence reports.
Familiarity with privacy, civil liberties, and HR compliance considerations regarding insider threat monitoring.

Responsibilities

Independently run daily operations, proactively identifying and triaging indicators of malicious, negligent, or coerced insider risk across multiple telemetry sources (DLP, SIEM, EDR/NDR, UAM, IAM).
Conduct end-to-end, self-directed risk scoring and categorization of user activity. Document notable cases, gather evidence, and recommend containment actions without requiring step-by-step guidance.
Work closely and dynamically within a small, specialized unit to share insights, cover operational gaps, and contribute insider updates to internal briefs and situational awareness (e.g., standups/shift changes).
Proactively maintain and refine a prioritized insider use-case catalog. Take ownership of weekly coordination with Applied Intelligence and platform owners to adjust playbooks and update risk-scoring thresholds.
Author Monthly InT Summaries focusing on insider-specific metrics, false positive trends, and emerging risk patterns. Act as the self-directed lead for designated case reviews to identify detection, process, and monitoring gaps.
Independently utilize SPLUNK architecture and UI/GUI development skills to optimize data analysis workflows. Oversee User Activity Monitoring (UAM) tools like Teramind to support robust incident reporting.