Insider Threat Monitoring Lead (CBP

About Agile Defense

At Agile Defense we know that action defines the outcome and new challenges require new solutions. That’s why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next.

Our vision is to bring adaptive innovation to support our nation’s most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility—leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation’s vital interests.

Title:

Insider Threat Monitoring Lead (CBP)

Clearance:
Active CBP Background Investigation (CBP BI) and EOD strongly preferred. We can begin processing for candidates who do not hold one.

Citizenship: U.S. Citizenship required

Location:

Ashburn, VA - Hybrid

Salary Range: [Pending]

Signing Bonus: $10,000 for candidates with an active CBP BI. Payable after 90 days; standard terms apply.

Travel:
Rare, as needed

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission hold sensitive law enforcement and personal data, and the people with legitimate access to it are, by definition, trusted. Most of the damage an insider threat program exists to catch does not come from a sophisticated outside attacker.

It comes from someone who already has the access, and the work is telling the difference between normal use and misuse without treating every employee as a suspect.

You lead that function. You will build and run the monitoring, analysis, and escalation process that catches insider risk early, working closely with the Security Operations Center Manager, human resources and security partners, and the incident response and digital forensics leads when a case moves from monitoring to action.

One thing is worth knowing before you apply. This work carries real privacy and proportionality weight. Getting it wrong in either direction, missing real risk or treating ordinary behavior as suspicious, costs the program trust it needs to keep doing the job.

Objective 1:
Catch real insider risk without drowning in noise

• Cases that escalated to investigation are the ones that warrant it, not everything that triggered an alert.
• Patterns that matter, unusual access, data movement, or behavior change, get identified before they become an incident rather than after.
• Analysts working under you can explain why a case escalated in terms someone outside the program would find reasonable.

Objective 2:
Run the program in a way people can trust is fair

• Monitoring stays proportional to actual risk indicators rather than expanding because it is easy to collect more data.
• Cases get handled consistently regardless of who the subject is.
• When a case does not substantiate, it closes cleanly rather than leaving a lingering question mark on someone's record.

Objective 3:
Hand off cleanly when a case becomes something else

• Cases that move to investigation or incident response arrive with a record that the next team can act on immediately, not one they have to reconstruct.
• You know where insider threat monitoring's job ends and where forensics or HR involvement begins, and you do not sit on a case past that line.
• Findings that reveal a systemic gap, not just an individual case, reach the people who can fix the gap.

Objective 4:
Improve what the program watches for over time

• Detection logic gets tuned based on what real cases actually looked like, not left static after initial setup.
• Near misses and lessons learned change what the program monitors going forward.
• You can explain the program's current blind spots honestly,…