Senior Manager, Insider Threat Incident Response

JOB SUMMARY 

 

Responsible for operating and evolving a framework for insider risk incident response and mitigation supporting the Global Insider Threat Management Program. Duties will include overseeing incident response to insider incidents and collaborating with multiple areas of the business, including managers, human resources, franchise services, legal, investigations, physical security, SOC/CIRT, and information technology groups. The Sr. Manager will manage cradle-to-grave incident management through problem and vulnerability mitigation through additional controls, processes and training. This includes assisting with program metrics (KPI/KRI) to ensure the advancement of the program across the enterprise, while mitigating human risk to the organization. 

 

CANDIDATE PROFILE 

 

Education and Experience 

 

Required: 

• Bachelor’s degree or equivalent experience/certification 

• 7+ years’ experience in insider threat/risk, or information security that includes cross-functional incident response, risk assessments, threat mitigation, and/or investigative support. 

• Experience conducting interviews of witnesses, subjects of wrongdoing, and producing written documentation for legal and HR counterparts 

• Strong computer use skills, including Microsoft Outlook, Word, Excel, SharePoint and other applications 

 

Preferred: 

• Current certifications, including Certified Insider Threat Program Manager, Certified Insider Threat Vulnerability Assessor, Certified Threat Manager. 

• Project management skills 

• Excellent communication skills and problem-solving ability 

• Demonstrated ability to work independently and with others 

• Ability to manage the details and compliance with standards and expectations 

• Prior experience with SIEM, UEBA, and DLP  

 

CORE WORK ACTIVITIES 

 

Insider Threat Management & Response 

• Operate and improve an existing process to respond and mitigate insider threats (identified and referred by the analysts and threat hunting team) by referring incidents for action to the correct stakeholders, ensuring appropriate and consistent responses, tracking results and preparing metrics and KPIs. 

• Conduct complex, confidential investigations into potential insider threats involving data exfiltration, sabotage, fraud, or behavioral anomalies in partnership with CIRT/SOC, Department of Investigations, HR, Legal teams and others. 

• Responsible for gathering relevant intelligence regarding insider threat tactics, techniques, and procedures. 

• Contribute to the continuously evolving the Global Insider Threat Management Program roadmap, technology stack, and governance. 

• Act as a technical subject matter expert to enhance adjacent programs such as incident response, threat hunting, and custom detection development. 

• Develop and report on key metrics of the insider threat management program. 

• Perform analysis of incident trends and outcomes for Insider Threat hunt pivoting and business communications to address identified issues. 

• Manage the analysis of artifacts to determine potential specific adversary and motives. 

• Respond to crisis or urgent situations within the pertinent domain to mitigate immediate and potential threats and comply with relevant data breach laws. Use mitigation, preparedness, and response and recovery approaches, as needed, to maximize safety and security of systems, preservation of intellectual property, and information security. Investigates and analyzes a