Specialist, Cybersecurity - Insider Threat Response Analyst

Job Summary

The Specialist, Cybersecurity supports Nationwide's Insider Threat Program by monitoring and triaging alerts related to potentially suspicious employee, contractor, and user activity. The role helps identify possible policy violations, unauthorized activity, and data loss or exfiltration risks by reviewing alerts, analyzing logs and contextual information, gathering evidence, documenting cases, and escalating validated concerns to the appropriate investigation team. The team's primary monitoring tool is Microsoft Purview Insider Risk Management, with additional detections in a Palo Alto SIEM environment.

Role Focus Areas

The hiring team considers two related profiles. Candidates may align more strongly with one focus area:

• Insider Risk Monitoring and Alert Triage
  • Monitor and review Microsoft Purview Insider Risk Management alerts.
  • Triage alerts and validate whether user activity appears suspicious or requires further review.
  • Gather relevant context and supporting evidence, apply sound judgment, and distinguish potentially risky activity from legitimate or personal activity where appropriate.
  • Create and document investigation cases, then escalate validated cases to the deeper investigation team.
  • Review activity involving potential data exfiltration, suspicious external sharing, unusual use of tools, policy violations, and other insider-risk indicators.
• Insider Threat Detection and SIEM Analysis
  • Review and analyze alerts and detections in the Palo Alto SIEM environment.
  • Search and correlate logs to assess suspicious activity and investigate security events.
  • Review existing detection logic and recommend tuning to improve detection quality and reduce false positives.
  • Support the maintenance and improvement of queries, dashboards, automation, and investigation workflows.
  • Use query-based analysis to identify patterns, validate detections, and provide recommendations for improvement.

Key Responsibilities

• Monitor insider-risk and security alerts generated by Microsoft Purview and other relevant security tools.
• Analyze user activity, authentication events, endpoint activity, and security logs to validate suspicious behavior.
• Recognize potential data theft or exfiltration, unauthorized access, misuse of privileges, policy violations, and suspicious use of applications or tools.

Qualifications

• Experience: 5-8 years
• Positions: 2

Skills

• Cybersecurity operations
• security alert triage
• SIEM
• log analysis
• investigation of suspicious activity
• Microsoft Purview
• Palo Alto SIEM
• query-based detection analysis

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.