Sr Cybersecurity Engineer

NiSource•Columbus, OH

About The Position

At NiSource, the Enterprise Security department is responsible for engineering sophisticated defenses to protect critical cyber and operational infrastructure. The Sr Cybersecurity Engineer – Insider Threat serves as a senior technical leader, tasked with designing, engineering, and operationalizing capabilities to detect, prevent, and respond to insider risk across enterprise IT, cloud, and operational environments. This role specifically focuses on identifying malicious, negligent, and compromised-user behaviors through advanced monitoring, analytics, behavioral detection, and data protection controls. The engineer will collaborate closely with Security Operations, HR, Legal, Compliance, Privacy, and Data Governance to ensure that insider risk capabilities are technically sound, legally defensible, and compliant with regulatory obligations such as NIST CSF and NERC CIP. Key responsibilities include building and sustaining technical controls across identity systems, endpoint telemetry, DLP platforms, UEBA solutions, cloud environments, and security data platforms. This position is crucial for translating insider threat risk into actionable detection logic, automation, and engineered safeguards that protect intellectual property, customer data, and critical infrastructure. Ultimately, this role plays a strategic part in enabling trusted workforce operations while significantly reducing organizational risk through measurable and defensible insider threat detection and mitigation capabilities.

Requirements

Bachelor's Degree in Computer Science, Information Technology, Cybersecurity, or a related field is preferred. However, equivalent professional experience, military service, relevant certifications, substantial industry tenure, or technical training may be considered as a substitute for formal education.
5+ years of experience in designing and implementing robust security solutions.
Experience with secure coding practices and Application Security.
Proficiency in Cybersecurity principles, IT infrastructure, and Application Security.
High Understanding of Network Security protocols, Cryptography, and secure network architectures.
High Familiarity with Cloud Security, including IaaS, PaaS, and SaaS models.
High Knowledge of Cybersecurity frameworks such as NIST CSF.
Medium Expertise in Penetration Testing and Ethical Hacking.
Low In-depth knowledge of developing secure network architectures and defense strategies.
High Expertise in secure software development lifecycle practices.
Medium Demonstrated leadership and team mentoring abilities.
Authorized to work in the United States without requiring sponsorship.

Nice To Haves

Advanced degrees or professional certifications such as CISSP, CISM, CEH, or equivalent.
Contributions to Cybersecurity research or thought leadership in industry forums.
Experience with AI and ML technologies in Cybersecurity.

Responsibilities

Develop and fine-tune security monitoring tools.
Engineer solutions for incident detection and response.
Implement patches and remediations.
Engineer secure network and system architectures.
Implement IAM solutions.
Automate compliance monitoring and reporting.
Integrate threat intelligence into security tools.
Develop training materials and simulations.
Implement cloud security controls and measures.
Analyze pen-testing results and engineer defenses.
Enforce policy adherence through technical solutions.
Pilot new security solutions.
Design behavioral baselines and anomaly detection models leveraging SIEM, XDR, and data lake platforms.
Engineer and tune data loss prevention (DLP) controls across endpoint, cloud, email, collaboration platforms, and SaaS applications.
Perform advanced Identity and Access Management (IAM) integrations, privileged access monitoring, identity anomaly detection, and federation risk analysis.
Integrate telemetry from endpoints, identity providers, SaaS platforms, badge systems, and HR systems into unified detection pipelines.
Develop high-fidelity use cases aligned to insider kill chains (data staging, privilege abuse, exfiltration, policy violations).
Engineer monitoring for M365, Azure, collaboration platforms, and other enterprise SaaS environments.
Engineer audit retention, chain-of-custody readiness, and evidence collection capabilities for forensics and investigative support.
Build automated workflows for investigation, containment, and escalation.
Design monitoring solutions that balance workforce privacy considerations with enterprise risk reduction.
Leverage advanced analytics, including AI/ML, to enhance anomaly detection, insider risk scoring, and alert prioritization.