- Company Name
- Ares Management
- Job Title
- Cybersecurity Operations (Insider Threat Investigations Lead)
- Job Description
-
**Job Title:**
Cybersecurity Operations – Insider Threat Investigations Lead
**Role Summary:**
Lead the detection, investigation, and remediation of insider threat activities across the enterprise. Oversee tooling adoption, develop investigative procedures, and ensure compliance with legal and regulatory standards while collaborating with cross‑functional teams.
**Expectations:**
- Conduct thorough investigations of anomalous behavior using monitoring platforms.
- Provide expertise on insider‑threat tooling and guide its deployment.
- Maintain high integrity handling confidential data; work flexible hours as needed.
- Operate in a hybrid on‑site/remote model and interact effectively with diverse stakeholders.
**Key Responsibilities:**
- Use UEBA, SIEM, and related platforms to identify and analyze insider risk.
- Lead investigations, coordinate support from IT, legal, and HR, and prepare chain‑of‑evidence.
- Draft and maintain standard operating procedures, workflows, and documentation for investigations.
- Advise on onboarding and operationalization of new insider‑threat tools; evaluate additional solutions.
- Ensure investigative activities comply with privacy, labor, and corporate‑governance regulations.
- Prioritize incidents based on enterprise risk and deliver timely findings.
**Required Skills:**
- Deep knowledge of insider‑threat indicators, data‑exfiltration patterns, and cybercrime tactics.
- Experience with UEBA, behavioral baseline development, and anomaly detection.
- Understanding of cyber‑security frameworks, attack methodologies, SIEM signatures, and network protocols (TCP/IP, SSL/TLS, etc.).
- Familiarity with logs from OS, web servers, databases, firewalls/NIDS/NIPS.
- Knowledge of IAM, cloud identity models, privileged access management, and data‑exfiltration risks.
- Strong analytical, critical‑thinking, and problem‑solving abilities.
- Excellent written and verbal English communication.
- Ability to work flexible hours and adapt to evolving environments.
- Preferred tool experience: SIEM (Microsoft Sentinel, Splunk), EDR/XDR (CrowdStrike, SentinelOne), Vulnerability Management, Attack Surface Management, Network Detection & Response, Insider Threat platforms.
- Programming/analysis experience (Python, R, Jupyter) is a plus.
**Required Education & Certifications:**
- Bachelor’s degree in Computer Science, Information Technology, Business, or equivalent experience.
- 10–15 years of enterprise cybersecurity experience (financial, government, military, law enforcement, or technology sectors).
- Recommended certifications: CISSP, CCSK, GIAC, OSCP (or equivalent).
- Proven experience in incident response, detection engineering, threat hunting, or SIEM/DLP/Insider Threat platforms.