Lead Corporate Security Operations Analyst (Insider Threat Program Lead)
About The Position
The Security Event Management group is seeking a highly motivated and experienced security professional to lead the direction and continued maturity of Mastercard's Insider Threat capability. As the Lead Insider Threat specialist, you will serve as the functional authority for Insider Threat across Security Operations, setting direction, defining standards, and driving the evolution of people, process, and technology capabilities that enable the organization to identify, detect, and respond to insider risk. This role provides leadership through expertise, influence, and decision-making, working across a global network of security and business stakeholders. The role is responsible for establishing and maintaining the Insider Threat operating model and guiding the implementation of improvements across Data Loss Prevention (DLP), User Activity Monitoring (UAM), User Behavior Analytics (UBA), investigations, detection content, monitoring procedures, case management processes, and supporting technologies. Working closely with Security Operations SMEs and operational teams, you will identify capability gaps, define enhancements, develop roadmap priorities, and ensure the Insider Threat function continues to mature in response to evolving business requirements and threat landscapes. You will act as the primary advisor on Insider Threat strategy, policies, standards, and procedures, balancing security objectives with business, privacy, legal, regulatory, and human resources requirements. Through collaboration and influence, you will drive consistency, operational excellence, and the adoption of best practices across the organization. This role requires a forward-looking mindset, continually assessing emerging Insider Threat tactics, techniques, and procedures (TTPs), industry trends, and technological advancements to develop and implement improvements that strengthen Mastercard's overall Insider Threat capability and long-term resilience. As operational needs arise, this role may directly lead investigations or incident response activities.
Requirements
- A demonstrated ability to conduct, oversee, or support sensitive, confidential investigations involving employee activity while maintaining the highest standards of professionalism, discretion, objectivity, evidentiary integrity, and privacy compliance, also balancing security, privacy, legal, and human resources considerations.
- Extensive experience in security operations, incident response, insider risk, digital forensics, or related cybersecurity disciplines.
- A strong understanding of investigative methodologies, evidentiary handling, chain of custody, and detailed report writing, with the ability to influence stakeholders and explain complex technical matters to diverse audiences.
- The ability to consistently apply an understanding of privacy, data protection, and regulatory considerations, including GDPR and related legislation, to operational requirements.
- Experience developing, enhancing, or governing Insider Threat, Data Loss Prevention, User Activity Monitoring, User Behavior Analytics, or related security capabilities.
- Experience with Microsoft security technologies, including Microsoft Purview, Microsoft Defender / IRM, Microsoft Sentinel, and Endpoint DLP.
- Experience with Security Information and Event Management (SIEM) platforms and security event analysis.
- Working knowledge of Windows and macOS operating systems, including key architectural and investigative differences.
- Familiarity with threat hunting methodologies, open-source intelligence (OSINT), and cyber investigation techniques.
Nice To Haves
- Relevant industry certifications such as CISSP, GCIH, GCIA, Security+, or equivalent.
Responsibilities
- Set Insider Threat investigation standards and guide SMEs on complex, high-risk cases.
- Analyze program trends, risks, and metrics to identify improvements and support leadership decisions.
- Build Insider Threat detection strategies, controls, and countermeasures aligned to emerging TTPs.
- Drive the direction and maturity of DLP, UAM, and UBA capabilities with technology owners.
- Maintain Insider Threat policies, processes, procedures, and operating standards.
- Serve as the lead Insider Threat liaison for Technology, Security, HR, Legal, Privacy, Compliance, and M&A partners.
- Assess capabilities and risks, identify control gaps, define remediation plans, and drive the resolution of issues.
- Define capability roadmaps and partner with engineering teams to deliver tool and platform enhancements.
- Track industry trends, emerging threats, and best practices to advance program maturity.
- Maintain current, accurate, and published program documentation and inventories.
- Design exercises to test and strengthen Insider Threat capabilities.
- Lead the Insider Threat Working Group and escalate priorities to the Insider Threat Steering Committee.
Benefits
- insurance (including medical, prescription drug, dental, vision, disability, life insurance)
- flexible spending account and health savings account
- paid leaves (including 16 weeks of new parent leave and up to 20 days of bereavement leave)
- 80 hours of Paid Sick and Safe Time
- 25 days of vacation time and 5 personal days, pro-rated based on date of hire
- 10 annual paid U.S. observed holidays
- 401k with a best-in-class company match
- deferred compensation for eligible roles
- fitness reimbursement or on-site fitness facilities
- eligibility for tuition reimbursement
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
