Senior Manager, Insider Threat Incident Response

Insider Threat Management Sr. Manager

Responsible for operating and evolving a framework for insider risk incident response and mitigation supporting the Global Insider Threat Management Program. Duties will include overseeing incident response to insider incidents and collaborating with multiple areas of the business, including managers, human resources, franchise services, legal, investigations, physical security, SOC/CIRT, and information technology groups. The Sr. Manager will manage cradle-to-grave incident management through problem and vulnerability mitigation through additional controls, processes and training.

This includes assisting with program metrics (KPI/KRI) to ensure the advancement of the program across the enterprise, while mitigating human risk to the organization.

Education and Experience

Required:

• Bachelor's degree or equivalent experience/certification
• 7+ years' experience in insider threat/risk, or information security that includes cross-functional incident response, risk assessments, threat mitigation, and/or investigative support.
• Experience conducting interviews of witnesses, subjects of wrongdoing, and producing written documentation for legal and HR counterparts
• Strong computer use skills, including Microsoft Outlook, Word, Excel, SharePoint and other applications

Preferred:

• Current certifications, including Certified Insider Threat Program Manager, Certified Insider Threat Vulnerability Assessor, Certified Threat Manager.
• Project management skills
• Excellent communication skills and problem-solving ability
• Demonstrated ability to work independently and with others
• Ability to manage the details and compliance with standards and expectations
• Prior experience with SIEM, UEBA, and DLP

Core Work

Activities:

• Insider Threat Management & Response
• Conduct complex, confidential investigations into potential insider threats involving data exfiltration, sabotage, fraud, or behavioral anomalies in partnership with CIRT/SOC, Department of Investigations, HR, Legal teams and others.
• Responsible for gathering relevant intelligence regarding insider threat tactics, techniques, and procedures.
• Contribute to the continuously evolving the Global Insider Threat Management Program roadmap, technology stack, and governance.
• Act as a technical subject matter expert to enhance adjacent programs such as incident response, threat hunting, and custom detection development.
• Develop and report on key metrics of the insider threat management program.
• Perform analysis of incident trends and outcomes for Insider Threat hunt pivoting and business communications to address identified issues.
• Manage the analysis of artifacts to determine potential specific adversary and motives.
• Respond to crisis or urgent situations within the pertinent domain to mitigate immediate and potential threats and comply with relevant data breach laws. Use mitigation, preparedness, and response and recovery approaches, as needed, to maximize safety and security of systems, preservation of intellectual property, and information security. Investigates and analyzes all relevant security and privacy response activities.
• Conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations or enterprise or local policy, assess the level of risk, and develop and/or recommend and operationalize appropriate mitigation countermeasures.
• Identify and assess the capabilities and activities of; produce findings to help initialize or support law enforcement and counterintelligence investigations or activities.
• Synthesizes and places regulatory and intelligence information in context; draws insights about the possible implications
• Submits reports in a timely manner, ensuring delivery deadlines are met.
• Promotes the documenting of project progress accurately.
• Provides input and assistance to other teams regarding projects.
• Manages and implements work and projects as assigned.
• Generates and provides accurate and timely results in the form of reports, presentations, etc.
• Analyzes information and evaluates results to choose the best solution and solve problems.
• Provides timely, accurate, and detailed status reports as requested.
• Provides technical expertise and support to people inside and outside of the department.
• Demonstrates knowledge of job-relevant issues, products, systems, and processes.
• Demonstrates knowledge of function-specific procedures.
• Keeps up-to-date technically and applies new knowledge to job.
• Uses computers and computer systems (including hardware and software) to enter data and/ or process information.
• Understands and meets the needs of key stakeholders.
• Develops specific goals and plans to prioritize, organize, and accomplish work.
• Determines priorities, schedules, plans and necessary resources to ensure completion of any projects on schedule.
• Collaborate with internal partners and stakeholders to support business/initiative strategies
• Communicate concepts in a clear and persuasive manner that is easy to understand.
• Generates and provides…