Head of Insider Risk - USDS

About the Team

The USDS JV Insider Risk team is responsible for protecting Tik Tok’s people, data, and systems from threats that originate within the organization. We partner across Security, Legal, HR, IT, and Engineering to detect, investigate, and mitigate insider risks ranging from data exfiltration and policy violations to fraud and unauthorized access.

We are seeking a Insider Risk Program Lead to own the strategy, maturity, and day-to-day operations of our insider risk program. This is a leadership role: you will define program vision, build and mentor a team of investigators and analysts, establish policy and process frameworks, and serve as the senior point of contact for insider risk across the organization. The ideal candidate combines deep technical expertise in digital forensics and incident response (DFIR) with proven program-building experience and strong cross-functional leadership skills.

• Own the end-to-end insider risk program — strategy, roadmap, policies, playbooks, and success metrics — and drive continuous maturity improvements aligned with industry frameworks (NIST, CISA, Carnegie Mellon CERT).
• Build, lead, and mentor a high-performing team of insider risk investigators and analysts; establish clear roles, career development paths, and performance standards.
• Design and operationalize detection and monitoring capabilities using SIEM, EDR, DLP, UEBA, and cloud-native logging (AWS Cloud Trail, Azure Monitor, GCP Audit Logs) to identify behavioral indicators of insider threats.
• Oversee complex investigations involving data exfiltration, intellectual property theft, unauthorized access, fraud, and policy violations; ensure forensic rigor, defensible evidence handling, and chain-of-custody integrity.
• Develop and refine risk-scoring models and behavioral analytics that prioritize high-risk activity — including exfiltration via email, cloud storage, USB, and lateral movement within internal networks.
• Partner with Security & Privacy, Legal, HR/ER, IT, and Engineering leadership to coordinate investigations, remediation actions, and policy enforcement; serve as the primary insider risk advisor to senior stakeholders.
• Deliver executive-level reporting on program health, investigation outcomes, risk trends, and key performance indicators; translate technical findings into business-relevant narratives for leadership and audit audiences.
• Define tooling strategy and manage the insider risk technology stack — evaluate, select, and optimize platforms for forensics, monitoring, case management, and analytics.
• Establish and maintain insider risk awareness and training initiatives to promote a security-conscious culture; develop tabletop exercises and simulations to validate program readiness.
• Stay ahead of the evolving threat landscape by tracking emerging insider risk TTPs, regulatory requirements, and best practices in forensic analysis, incident response, and privacy-preserving monitoring.

• Bachelor’s degree in Cybersecurity, Digital Forensics, Information Technology, Computer Science, or equivalent professional experience in related fields as well as minimum 5 years of progressive experience in insider risk, digital forensics, incident response, or cybersecurity investigations, with at least 2 years in a team lead, manager, or program-owner capacity.
• Demonstrated experience standing up or materially maturing an insider risk or insider threat program, including policy development, detection engineering, and cross-functional governance.
• Expertise in digital forensic tools (e.g., EnCase, FTK, Cellebrite, X-Ways, AXIOM) and scripting languages (Python, Bash, Power Shell) for automation and analysis.
• Advanced…