Principal Insider Threat Analyst

Salesforce•McLean, VA

About The Position

We are seeking a Principal Insider Threat Analyst to take a leading role in maturing our Insider Threat Program. We're looking for a candidate who combines deep technical skills (expertise in detections, hunts, and investigations) with a proven history of program leadership (turning goals into concrete capabilities, playbooks, and partnerships). This is a hands-on technical position that combines deep investigative expertise with the strategic vision to shape how the program operates over time.

Requirements

12+ years experience in cybersecurity, incident response, intelligence, insider threat or counterintelligence, with at least 5+ years leading and managing insider threat and/or counterintelligence investigations
Deep knowledge of procedures and indicators of malicious insider threat activity such as fraud, theft, sabotage, espionage, etc.
Ability to identify and build new capabilities or processes as the scaling needs arise
Demonstrated experience creating and employing effective strategies at scale
Must have strong verbal and written communication skills; ability to communicate effectively and clearly to executive leadership.
The ability to build strong relationships with peers both internal and external to your functional group, and with peers/professional organizations outside your company.
A related technical degree required

Responsibilities

Be Salesforce’s subject matter expert in insider threat.
Conduct investigations into the most complex and sensitive insider-threat matters across all of Salesforce.
Own the investigation from initial signal through evidence preservation, timeline reconstruction, interview support, documentation, and handoff to partner teams.
Architect proactive threat hunting operations for insiders and translate the results of those hunts into investigations and high fidelity detections.
Evolve and maintain the model for a world class insider threat analysis program.
Identify tooling and coverage gaps, metrics, and where to invest next.
Build and maintain the processes and playbooks the team uses.
Contribute to risk assessments for crown jewel analysis, high-sensitivity roles, M&A activity
Drive cross-functional alignment through building and maintaining relationships with partners across Salesforce