cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

Insider Threat Program Lead

Security Operations & Incident ResponseConfirmed live in the last 24 hours

Full-timeWashington, DC, USANo salary listedIn-person

About the Job

Requirements

At least 10 years of experience in cybersecurity, counterintelligence, investigations, or insider threat.
At least 5 years of experience supporting insider threat or behavioral analytics programs.
Experience supporting federal agencies or classified environments.
Experience with user and entity behavior analytics platforms, security information and event management analytics, data loss prevention, identity analytics, and investigative workflows.
Knowledge of National Institute of Standards and Technology insider threat guidance, behavioral analytics, digital forensics, and investigative methodologies.
Strong briefing and stakeholder coordination skills.

Responsibilities

Lead insider threat operations, analytics, and investigative support activities.
Develop insider threat detection methodologies and behavioral analytics use cases.
Coordinate with security operations center, cyber threat intelligence, human resources, legal, counterintelligence, and security stakeholders.
Develop insider threat monitoring strategies leveraging user and entity behavior analytics, security information and event management, endpoint detection and response, data loss prevention, and identity telemetry.
Lead investigations involving data exfiltration, privilege misuse, anomalous behavior, credential abuse, and policy violations.
Develop insider threat reporting, escalation, and case management procedures.
Conduct threat assessments and risk-based prioritization.
Support development of insider threat dashboards, metrics, and executive briefings.
Assist with policy development, governance, and workforce awareness initiatives.
Participate in oral presentations and technical solution development.

Desired Qualifications

CISSP certification.
CISM certification.
GCFE certification.
GCFA certification.
CIPP certification.
Insider Threat Program Manager certification.
Behavioral analytics or fraud investigation certification.

Position Title
Insider Threat Program Lead
Position Overview
The Insider Threat Lead will design, mature, and oversee insider threat detection, analysis, and investigative support capabilities for a federal enterprise environment. The Lead will integrate user activity monitoring, behavioral analytics, threat intelligence, and investigative workflows to identify and mitigate malicious, negligent, or compromised insider activity.
The ideal candidate possesses experience supporting insider threat programs within federal, intelligence community, law enforcement, or highly regulated environments.
Key Responsibilities

Lead insider threat operations, analytics, and investigative support activities.
Develop insider threat detection methodologies and behavioral analytics use cases.
Coordinate with SOC, CTI, HR, legal, counterintelligence, and security stakeholders.
Develop insider threat monitoring strategies leveraging:
- UEBA,
- SIEM,
- EDR,
- DLP,
- and identity telemetry.
Lead investigations involving:
- data exfiltration,
- privilege misuse,
- anomalous behavior,
- credential abuse,
- and policy violations.
Develop insider threat reporting, escalation, and case management procedures.
Conduct threat assessments and risk-based prioritization.
Support development of insider threat dashboards, metrics, and executive briefings.
Assist with policy development, governance, and workforce awareness initiatives.
Participate in oral presentations and technical solution development.

Required Qualifications

10+ years of cybersecurity, counterintelligence, investigations, or insider threat experience.
5+ years supporting insider threat or behavioral analytics programs.
Experience supporting federal agencies or classified environments.
Experience with:
- UEBA platforms,
- SIEM analytics,
- DLP,
- identity analytics,
- and investigative workflows.
Knowledge of:
- NIST insider threat guidance,
- behavioral analytics,
- digital forensics,
- and investigative methodologies.
Strong briefing and stakeholder coordination skills.

Preferred Certifications

CISSP
CISM
GCFE
GCFA
CIPP
Insider Threat Program Manager certifications
Behavioral analytics or fraud investigation certifications

About the Company

cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

cFocus Software provides cybersecurity, cross-domain, geospatial, and IT services to federal government agencies. It designs and manages security architectures, conducts risk assessments, ensures compliance, and delivers IT and geospatial data solutions tailored to federal requirements. The company differentiates itself through 18+ years of government-focused experience across dozens of agencies and established, government-facing delivery processes. Its goal is to help federal agencies protect, operate, and optimize their IT and geospatial capabilities for secure and compliant government operations.

Company size: 11-50
Company stage: Not listed
Total funding: Not listed
Headquarters: Largo, FL
Founded: 2006

Recently Posted Jobs

Explore more opportunities at cFocus Software

See more jobs