Insider Threat Analyst

Position Overview:
- The candidate will examine, analyze, and search insider threat data to identify trends, patterns, and insights of potential insider threat indicators.
- Provide analytical, program support services related to the operation of UAM/UEBA tools.
- Monitor UAM platform to identify emerging requirements related to insider threat events and coordinate across the enterprise to ensure timely response.
- Conduct further research on the UAM platform to identify patterns of concerning behavior related to a potential insider threat risk to the DHS enterprise.
- Provide proactive insider threat-based hunting across the DHS enterprise network, leveraging methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations indicative of malicious insider behavior.
- Conduct continuous hunt operations across data and log sources, DHS platforms, EDR tools, and network traffic to identify patterns of insider threat behavior.
- Identify mitigation strategies to assist the investigative team in effectively reducing insider threat risk.
- Utilize UEBA (User and Entity Behavior Analytics) platforms and techniques to baseline user activity and detect deviations.
- Provide timely response to critical/high UAM alerts within 4 hours during normal business hours.

Required Qualifications:
- Bachelor’s degree and 12+ years of prior relevant insider threat experience or Master’s degree with 10+ years of prior relevant experience.
- Additional years of experience with requisite certifications will be considered in lieu of degree.
- Minimum of 10+ years demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations.
- Minimum of 10+ years demonstrated knowledge of threat assessment and mitigation strategies.
- Excellent written and verbal skills with ability to deliver briefings to a diverse group of audiences.
- Knowledge of current domestic and international threats to U.S. national security interests.
- Ability to establish networks with relevant security, personnel, and prevention stakeholders to foster program utilization.
- Self-starter capable of working independently to promote program goals.
- Working knowledge of User Activity Monitoring Software (UAM) and solutions.
- Working knowledge of cybersecurity toolsets designed to support ITP mission activities.
- Working knowledge of open-source toolsets.
- Working knowledge of insider threat frameworks, pathway to violence, and critical pathway.
- Current TS/SCI clearance.
- Must be a U.S. citizen.
- Willingness to undergo CI Polygraph.

Preferred Qualifications:
- Master’s degree from an accredited college or university in Criminal Justice, Homeland Security, Cyber Security, or related field.
- Proven experience of 10+ years in intelligence analysis.
- Experience with User Activity Monitoring products and platforms.
- Proven experience of 4+ years in threat assessment and mitigation.
- Certified Counter-Insider Threat Professional - Fundamentals (CCITP-F).
- Certified Counter-Insider Threat Professional - Analysis (CCITP-A).
- Completion of Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC).
- Completion of Workplace Assessment of Violence Risk (WAVR-21) Workshop.
- Completion of Center for Development of Security Excellence (CDSE) curriculums INT311.CU, INT312.CU, and CI201.CU.

Location: TSA Headquarters, Springfield Center Drive, Springfield, VA, USA

Skills required for this job:

• Application monitoring
• Behavioral analytics
• Cybersecurity
• Intelligence analysis
• Risk mitigation
• Threat analysis
• Threat assesment
• UEBA
• uam