Cybersecurity Analyst - Insider Risk Analytics

Location: Remote (CST & EST preferred)

Employment Type: W2 Only

Job Description

The Cybersecurity Analyst - Insider Risk Analytics will provide specialized technical and analytical support to the client's global Insider Risk Management Program within the Cyber Fusion Centre. The role focuses on enhancing insider risk detection capabilities, supporting investigations, developing analytical use cases, and improving operational efficiency through advanced data analysis and automation.

The contractor will analyze and correlate complex datasets across multiple security technologies, develop detection logic, build dashboards and queries, and automate analytical and investigative processes. The position requires strong hands-on technical expertise in SIEM, UEBA, DLP, scripting, and data analytics. The role will also support proactive analysis of emerging insider and cyber threat trends and collaborate with internal teams to identify opportunities to improve detection accuracy and investigative effectiveness.

Summary of Primary Responsibilities

• Analyze and correlate large, complex datasets from multiple technical and non-technical sources to identify anomalous behaviors, potential insider threats, and data loss incidents.
• Provide technical expertise and respond to investigator inquiries regarding data and the broader technical environment to support insider risk investigations.
• Analyze alerts and associated data to identify false positives, improve detection precision, and enhance investigative effectiveness.
• Develop, test, and refine detection logic, analytical use cases, and monitoring queries, collaborating with Security Engineering on production detection improvements.
• Build and maintain dashboards, complex queries, and specialized monitoring capabilities to support investigations, including sensitive or close-hold Insider Risk activities.
• Develop scripts and automated workflows to streamline data correlation, alert enrichment, investigative analysis, and reporting.
• Conduct proactive analysis of emerging insider risk trends and security telemetry to identify suspicious behaviors and potential detection gaps.
• Identify and recommend improvements to insider risk detection capabilities based on analytical findings and lessons learned from investigations.
• Collaborate with Insider Risk, Security Engineering, DLP Engineering, and other security teams on technical detection and investigative activities.
• Produce technical documentation, analytical reports, dashboards, and standard operating procedures to support consistent investigative and monitoring processes.
• Provide technical and analytical support for broader Insider Risk and DLP activities as needed, following established procedures and escalation requirements.

Required Skills and Experience

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, or a related field, or equivalent practical experience.
• Minimum 3-4 years of experience in cybersecurity investigations, security analytics, insider risk, or a related technical security discipline.
• Hands-on experience using SIEM, UEBA, and DLP technologies to analyze security events, investigate suspicious activity, and identify potential insider threats.
• Demonstrated ability to independently develop complex SIEM queries, correlation searches, dashboards, and analytical content using YARA-L, SPL, KQL, SQL, or equivalent query and detection languages.
• Experience analyzing and correlating large datasets across multiple security technologies to identify anomalies and behavioral patterns.
• Proficiency in scripting or programming languages such as Python, PowerShell, or equivalent technologies to automate analytical and investigative workflows.
• Experience with security monitoring, threat detection, incident response, and investigative processes within a SOC or similar cybersecurity environment.
• Strong analytical and problem-solving skills, with the ability to investigate complex technical issues and translate findings into actionable insights.
• Knowledge of insider and cyber threat trends, detection techniques, and opportunities to improve monitoring and analytical capabilities.
• Strong written and verbal communication skills, including the ability to explain technical findings to investigative teams and other stakeholders. Business-fluent English required.

Preferred Qualifications

• Experience supporting enterprise insider risk or data loss prevention programs.
• Familiarity with Google Security Operations (SecOps), including YARA-L detection logic and advanced security event analysis.
• Experience developing specialized dashboards, analytical workflows, or automated investigative solutions.
• Relevant certifications, including CERT Insider Threat Program Manager (ITPM) Certificate, Global Counter-Insider Threat Professional (GCITP), CISSP, GCIH, or other relevant GIAC certifications or SANS cybersecurity training.

Candidate Requirements

• Technology Requirements: SIEM, UEBA, DLP, Google Security Operations, YARA-L, SPL, KQL, SQL, Python, and PowerShell.
• Degree or Certifications: Bachelor's degree in Cybersecurity, Information Systems, Computer Science, or a related field, or equivalent practical experience.
• Years of Experience: 3-4+ years.
• Required Background: Cybersecurity investigations, security analytics, insider risk, SIEM, UEBA, DLP, and threat detection.
• Nice-to-Haves: Google SecOps, YARA-L, insider risk program experience, relevant cybersecurity certifications, and automated investigative solutions.

Top Candidate Skills

• Google Security Operations (SecOps): Hands-on experience with Google SecOps and security event analysis.
• SIEM Query Development: Ability to develop complex SIEM queries, correlation searches, dashboards, and analytical content using YARA-L, SPL, KQL, SQL, or equivalent languages.
• Cybersecurity Investigations & Insider Risk Analytics: Experience in cybersecurity investigations, security analytics, insider risk, or a related technical security discipline.

#LI-JS2