Senior Security Engineer - Insider Threat

Citizens Financial Group•Johnston, RI

21h•Hybrid

About The Position

Citizens is seeking a Senior Security Engineer to support the development and advancement of its Insider Threat Program within Data Protection and Security. The role strengthens the organization’s ability to identify, assess, detect, and respond to insider risk using security analytics, behavioral indicators, data analysis, and technology-enabled controls. The engineer assesses current insider-threat capabilities, identifies control and visibility gaps, develops technical and behavioral indicators, and improves analytics for detecting potentially risky activity. The role brings together security telemetry, user and entity behavior analytics, fraud indicators, and other data sources to improve insider-risk detection and response. It combines cybersecurity knowledge, analytical thinking, technical investigation skills, and the ability to turn complex activity patterns into actionable security insights. The position is hybrid, with four days onsite and one remote day per week. The posting lists hubs in Johnston, Rhode Island; Boston, Massachusetts; Marlton, New Jersey; Pittsburgh, Pennsylvania; Phoenix, Arizona; Irving, Texas; and Cleveland, Ohio. Remote work requires executive approval. The schedule is Monday through Friday, 8:00 AM to 5:00 PM, for 40 hours per week.

Requirements

Bachelor’s degree in Information Security, Computer Science, or a related field with at least 1 year of relevant experience, or equivalent professional experience.
A high school diploma or equivalent with at least 5 years of relevant professional experience may be considered in lieu of a bachelor’s degree.
Understanding of information security concepts, cybersecurity practices, and regulatory considerations related to insider threat and data protection.
Understanding of enterprise security and networking technologies and how they support the prevention, detection, investigation, and response to insider threats.
Experience analyzing security, behavioral, fraud, or related data to identify suspicious activity, anomalies, or potential risk.
Ability to analyze information from multiple data sources and translate findings into actionable security insights.
Strong analytical, investigative, and problem-solving skills.
Advanced proficiency with Microsoft Office applications, including Outlook, Word, Excel, and PowerPoint.
Excellent verbal and written communication skills.
Ability to communicate complex security concepts and investigative findings clearly to technical and non-technical stakeholders.
Ability to execute work independently while collaborating effectively across technical and business teams.

Nice To Haves

At least 3 years of experience in information security, cybersecurity, insider threat, security analytics, fraud detection, threat intelligence, or a related discipline.
Experience supporting or developing an enterprise Insider Threat Program.
Experience configuring or using User Behavior Analytics or User and Entity Behavior Analytics platforms.
Experience with security event monitoring, incident detection, incident response, threat intelligence, or enterprise network monitoring.
Experience developing detection logic, behavioral indicators, alerting methodologies, or security analytics.
Experience analyzing security or fraud-detection reports to identify potential incidents involving internal fraud, theft, data misuse, or misconduct.
Experience creating and maintaining insider-threat, fraud-detection, security-analytics, or risk reporting.
Advanced knowledge of statistics, modeling, anomaly detection, behavioral analytics, or alert tuning.
Knowledge of machine learning and its application to cybersecurity, behavioral analytics, or anomaly detection.
Experience as a security consultant or in a cybersecurity advisory capacity.
Experience within financial services or another highly regulated industry.
Experience working across Cybersecurity, Fraud, Human Resources, Legal, Risk, Compliance, and Technology on sensitive security investigations or risk initiatives.
Associate of ISC2, CISSP, Security+, or comparable cybersecurity certification.
Master’s degree in Information Security, Computer Science, Cybersecurity, Data Analytics, or a related field.

Responsibilities

Assess existing Insider Threat Program capabilities, identify gaps, and develop technical and non-technical indicators to improve insider-risk detection.
Develop and enhance analytics, detection logic, behavioral indicators, and reporting to identify potentially risky colleague activity.
Evaluate, implement, configure, and optimize security technologies that support insider-threat monitoring, investigation, and response.
Analyze security telemetry and data from multiple sources to identify anomalous activity, behavioral patterns, and potential insider risk.
Use user and entity behavior analytics, security monitoring, threat intelligence, and other analytical methods to identify suspicious or abnormal activity.
Investigate complex patterns of user activity and distinguish potentially malicious or high-risk behavior from expected business activity.
Partner with Cybersecurity, Fraud, Human Resources, Legal, Risk, Technology, and other internal teams to develop and operationalize insider-risk processes and controls.
Collaborate with internal technology teams to ensure enterprise platforms and colleague-facing tools provide appropriate data and telemetry for insider-threat and fraud detection.
Create, maintain, and enhance insider-threat and fraud-detection reporting using multiple internal and external data sources.
Interpret security and fraud analytics to identify and escalate potential incidents involving insider threats, internal fraud, theft, data misuse, or misconduct.
Apply statistical and analytical techniques to improve anomaly detection, alert quality, detection accuracy, and investigative effectiveness.
Identify opportunities to reduce false positives and strengthen the signal quality of insider-threat detections.
Develop and maintain technical documentation, detection methodologies, procedures, metrics, and program reporting.
Produce program metrics and insights communicating insider-risk trends, control effectiveness, detection coverage, and areas requiring additional attention.
Monitor evolving cyber threats, insider-threat techniques, behavioral indicators, and emerging technologies that could affect the organization’s risk profile.
Communicate technical findings, emerging threats, and recommended actions to cybersecurity teams and business stakeholders.

Benefits

Competitive pay and opportunity to earn additional incentive earnings.
Comprehensive medical coverage.
Dental coverage.
Vision coverage.
Retirement benefits.
Maternity and paternity leave.
Flexible work arrangements.
Education reimbursement.
Wellness programs.
Paid time off policy that exceeds mandatory paid sick or paid time-away policies in every local and state jurisdiction in the United States.
Access to training and tools to support career growth.