Senior Security Engineer - Insider Threat

Citizens Bank•Johnston, RI

8h•$114,000 - $152,000•Hybrid

About The Position

Citizens is seeking a Senior Security Engineer to support the development and advancement of its Insider Threat Program within Data Protection and Security. The role strengthens the organization’s ability to identify, assess, detect, and respond to insider risk using security analytics, behavioral indicators, data analysis, and technology-enabled controls. The engineer assesses current insider threat capabilities, identifies control and visibility gaps, develops technical and behavioral indicators, and improves methods for detecting potentially risky activity. The role brings together security telemetry, user and entity behavior analytics, fraud indicators, and other relevant data sources. It combines cybersecurity expertise, analytical thinking, technical investigation skills, and the ability to turn complex activity patterns into actionable security insights. The position is hybrid, with four onsite days and one remote day, and is listed for hubs including Johnston, Rhode Island; Boston, Massachusetts; Marlton, New Jersey; Pittsburgh, Pennsylvania; Phoenix, Arizona; Irving, Texas; and Cleveland, Ohio. The posting also lists Pittsburgh, Johnston, or remote as work arrangements, with remote work requiring executive approval. The schedule is Monday through Friday, 8:00 a.m. to 5:00 p.m., for 40 hours per week.

Requirements

Bachelor’s degree in Information Security, Computer Science, or a related field and at least 1 year of relevant experience, or equivalent professional experience.
A high school diploma or equivalent and at least 5 years of relevant professional experience may be considered instead of a bachelor’s degree.
Understanding of information security concepts, cybersecurity practices, and regulatory considerations related to insider threat and data protection.
Understanding of enterprise security and networking technologies and their role in preventing, detecting, investigating, and responding to insider threats.
Experience analyzing security, behavioral, fraud, or related data to identify suspicious activity, anomalies, or potential risk.
Ability to analyze information from multiple data sources and translate findings into actionable security insights.
Strong analytical, investigative, and problem-solving skills.
Advanced proficiency with Microsoft Office applications, including Outlook, Word, Excel, and PowerPoint.
Excellent verbal and written communication skills.
Ability to communicate complex security concepts and investigative findings clearly to technical and nontechnical stakeholders.
Ability to work independently while collaborating effectively across technical and business teams.

Nice To Haves

At least 3 years of experience in information security, cybersecurity, insider threat, security analytics, fraud detection, threat intelligence, or a related discipline.
Experience supporting or developing an enterprise Insider Threat Program.
Experience configuring or using User Behavior Analytics or User and Entity Behavior Analytics platforms.
Experience with security event monitoring, incident detection, incident response, threat intelligence, or enterprise network monitoring.
Experience developing detection logic, behavioral indicators, alerting methodologies, or security analytics.
Experience analyzing security or fraud detection reports to identify potential incidents involving internal fraud, theft, data misuse, or misconduct.
Experience creating and maintaining insider threat, fraud detection, security analytics, or risk reporting.
Advanced knowledge of statistics, modeling, anomaly detection, behavioral analytics, or alert tuning.
Knowledge of machine learning and its application to cybersecurity, behavioral analytics, or anomaly detection.
Experience as a security consultant or in a cybersecurity advisory capacity.
Experience in financial services or another highly regulated industry.
Experience working across Cybersecurity, Fraud, Human Resources, Legal, Risk, Compliance, and Technology on sensitive security investigations or risk initiatives.
Associate of ISC2, CISSP, Security+, or comparable cybersecurity certification.
Master’s degree in Information Security, Computer Science, Cybersecurity, Data Analytics, or a related field.

Responsibilities

Assess existing Insider Threat Program capabilities, identify gaps, and develop technical and nontechnical indicators to improve insider risk detection.
Develop and enhance analytics, detection logic, behavioral indicators, and reporting used to identify potentially risky colleague activity.
Evaluate, implement, configure, and optimize technologies supporting insider threat monitoring, investigation, and response.
Analyze security telemetry and data from multiple sources to identify anomalous activity, behavioral patterns, and potential insider risk.
Use user and entity behavior analytics, security monitoring, threat intelligence, and other analytic methods to identify suspicious or abnormal activity.
Investigate complex user activity and distinguish potentially malicious or high-risk behavior from expected business activity.
Partner with Cybersecurity, Fraud, Human Resources, Legal, Risk, Technology, and other internal teams to develop and operationalize insider risk processes and controls.
Collaborate with technology teams to ensure enterprise platforms and colleague-facing tools provide appropriate data and telemetry for insider threat and fraud detection.
Create, maintain, and enhance insider threat and fraud detection reporting using internal and external data sources.
Interpret security and fraud analytics to identify and escalate potential incidents involving insider threats, internal fraud, theft, data misuse, or misconduct.
Apply statistical and analytical techniques to improve anomaly detection, alert quality, detection accuracy, and investigative effectiveness.
Reduce false positives and strengthen the signal quality of insider threat detections.
Develop and maintain technical documentation, detection methodologies, procedures, metrics, and program reporting.
Produce program metrics and insights on insider risk trends, control effectiveness, detection coverage, and areas requiring additional attention.
Monitor evolving cyber threats, insider threat techniques, behavioral indicators, and emerging technologies that could affect the organization’s risk profile.
Communicate technical findings, emerging threats, and recommended actions to cybersecurity teams and business stakeholders.

Benefits

Competitive pay and opportunity to earn additional incentive earnings.
Comprehensive medical coverage.
Dental coverage.
Vision coverage.
Retirement benefits.
Maternity and paternity leave.
Flexible work arrangements.
Education reimbursement.
Wellness programs.
Paid time off policy that exceeds mandatory paid sick or paid time-away policies in every U.S. local and state jurisdiction.
Supportive and collaborative workforce.
Access to training and tools for career growth.