Insider Threat Investigator; Counterintelligence Officer

Position: Insider Threat Investigator (Counterintelligence Officer 3)
** What You Will Do*
* ** This position is open for external candidates only to apply.*
* Are you an experienced insider threat or counterintelligence professional? Are you interested in joining a dedicated team of professionals working to safeguard Los Alamos National Laboratory (LANL), its people, information, and mission? If so, we invite you to learn more about our opening for an Insider Threat Investigator 3. The Insider Threat Investigator 3 will support the identification, assessment, investigation, and mitigation of potential insider threats to LANL.

The successful candidate will work across counterintelligence, security, cybersecurity, human resources, legal, and management functions to evaluate concerning activity while appropriately protecting employee privacy, due process, and organizational assets. This position requires a seasoned investigator with strong investigative and analytical skills, sound judgment, discretion, and demonstrated ability to objectively assess complex information and distinguish anomalous or legitimate workplace activity from behaviors that may warrant further inquiry.

LANL investigative efforts support national counterintelligence and insider threat goals and objectives under the direction of the Foreign Immigration, Visits and Analysis (FVA) Group Leader and the Office of Counterintelligence (OCI) Director.

** In this position, you will:*
* + Conduct and support investigations involving suspected insider threat activity, including unauthorized disclosures, misuse of information or systems, data exfiltration, security violations, fraud, sabotage, and other potentially harmful activity.

+ Collect, review, analyze, and correlate information from authorized counterintelligence, cybersecurity, personnel security, physical security, investigative, and other relevant sources.

+ Develop investigative strategies, plans, timelines, leads, and documented findings.

+ Conduct investigative interviews and coordinate investigative activities with appropriate internal and external stakeholders.

+ Identify and assess behavioral, technical, and other indicators that may warrant additional inquiry or assessment.

+ Evaluate investigative information objectively, distinguish anomalous activity from substantiated risk, and develop well-supported findings and recommendations.

+ Prepare clear, concise, and factual investigative reports, briefings, referrals, and case documentation for technical and senior-level audiences.

+ Maintain investigative records in accordance with applicable laws, policies, privacy requirements, and records-management standards.

+ Collaborate with counterintelligence, cybersecurity, legal, human resources, employee relations, physical security, personnel security, and other organizational functions, as appropriate.

+ Support insider threat assessments and develop proportionate, risk-informed recommendations for mitigation.

+ Identify investigative trends, recurring indicators, and lessons learned that can strengthen LANL's insider threat posture, security controls, and prevention efforts.

+ Handle sensitive, controlled, and classified information with discretion and professionalism.

** What You Need*
* ** Minimum

Job Requirements:

*
* ** Counterintelligence and/or Insider Threat Investigative Experience*
* Demonstrated extensive experience conducting complex, end-to-end investigations, including investigative planning, information collection, interviewing, analysis of qualitative and quantitative information, development of findings, and preparation of investigative reports. Demonstrated knowledge of investigative principles and practices, evidence handling, privacy and civil liberties considerations, records management, and information-protection requirements. Knowledge of insider threat concepts, indicators, investigative methodologies, organizational roles, and relevant policies and authorities, such as Executive Order 13587 and DOE Order 470.5A.

Familiarity with cybersecurity and insider threat capabilities such as data loss prevention (DLP), security information and event management (SIEM), user and entity behavior analytics (UEBA), or related security technologies.

** Analysis, Reports, and Briefings*
* Demonstrated experience analyzing complex and potentially conflicting information, developing defensible findings and recommendations, and preparing professional investigative reports and other written products.

Demonstrated experience briefing investigative findings, assessments, and…