Position Overview

At PNC, our people are our greatest differentiator and competitive advantage in the markets we serve. We are all united in delivering the best experience for our customers. We work together each day to foster an inclusive workplace culture where all of our employees feel respected, valued and have an opportunity to contribute to the company’s success. As a Security Manager Sr within PNC's Technology organization, you will be based in Pittsburgh, PA; Cleveland, OH; Denver, CO; Birmingham, AL; or Phoenix, AZ.

Manager – Technical Insider Threat & Employee Investigative Services
Line of Business
Enterprise Information Security (EIS) / Global Security
________________________________________

Job Description Summary

The Manager of the Technical Insider Threat Team and Employee Investigative Services Group is responsible for leading PNC’s enterprise insider threat detection, investigation, and response program, with a specific focus on technical insider threat, employee misconduct with a cyber nexus, and insider fraud investigations. This role drives the integration of technical monitoring, behavioral analytics, investigative rigor, and cross functional coordination to protect PNC from malicious, negligent, and compromised insider activity.
The role serves as a key liaison between Cybersecurity, Human Resources, Legal, Compliance, Fraud, and Corporate Investigations, ensuring insider risk is identified early, investigated appropriately, and mitigated in accordance with PNC policy, regulatory expectations, legal requirements, and financial crime reporting obligations, including Suspicious Activity Reporting (SAR).
________________________________________
Key Responsibilities

Program Leadership & Strategy
• Lead PNC’s Technical Insider Threat Program, including detection, investigation, remediation, and continuous improvement
• Manage Employee Investigative Services activities related to insider fraud, misuse of systems, data exfiltration, and policy violations with a technical or cyber component
• Establish and maintain insider threat operating models, governance, metrics, and reporting
• Ensure alignment with NIST, Zero Trust, and regulatory guidance applicable to insider risk
Detection & Monitoring
• Oversee technical monitoring capabilities
• Partner with GSFC/SOC to operationalize insider threat detections and escalation workflows
• Continuously evaluate detection efficacy and reduce false positives
Investigations & Response
• Direct and oversee complex insider investigations, including potential fraud, sabotage, data theft, and policy violations
• Ensure investigations are documented, defensible, and compliant with HR, Legal, Compliance, and regulatory standards
• Coordinate evidence preservation, chain of custody, and forensic support
• Support disciplinary actions, terminations, and referrals as appropriate
Insider Fraud Oversight
• Lead investigations related to employee driven fraud involving systems misuse, payment manipulation, data access abuse, or collusion
• Partner with Fraud Risk Management, Ethics Office, Compliance, and Corporate Investigations on insider fraud matters
• Assess investigative findings for SAR reportability and support the preparation, review, and escalation of SARs involving insider activity, in coordination with Compliance and AML partners
• Identify trends and systemic control gaps contributing to insider fraud risk

Cross Functional Collaboration
• Act as a trusted partner to:
o Human Resources & Employee Relations
o Legal & Privacy
o Compliance & Risk Management
o Fraud Risk Management / AML
o Audit and Regulatory Affairs
• Support internal audits, regulatory exams, and management responses related to insider threat, employee investigations, and SAR governance
People Management
• Lead and develop a team of insider threat analysts and investigators
• Set priorities, manage workload, and ensure staff are trained on investigative, technical, legal, and SAR related requirements
• Foster a culture of confidentiality, professionalism, and risk awareness
Reporting & Governance
• Produce executive level metrics, dashboards, and briefings for senior leadership
• Maintain insider threat KPIs and trend analysis
• Contribute to policy development and updates related to employee monitoring, investigations, and insider related SAR processes
________________________________________

Qualifications
Required
• Bachelor’s degree in Cybersecurity, Information Systems, Forensics,