Specialist, Cybersecurity - Insider Threat Response Analyst

Specialist, Cybersecurity – Insider Threat Response Analyst

Position Summary

The Specialist, Cybersecurity supports Nationwide’s Insider Threat Program by monitoring and triaging alerts related to potentially suspicious employee, contractor, and user activity. The role helps identify possible policy violations, unauthorized activity, and data loss or exfiltration risks by reviewing alerts, analyzing logs and contextual information, gathering evidence, documenting cases, and escalating validated concerns to the appropriate investigation team. The team’s primary monitoring tool is Microsoft Purview Insider Risk Management , with additional detections in a Palo Alto SIEM environment.

Role Focus Areas

The hiring team considers two related profiles. Candidates may align more strongly with one focus area:

1. Insider Risk Monitoring and Alert Triage

• Monitor and review Microsoft Purview Insider Risk Management alerts.
• Triage alerts and validate whether user activity appears suspicious or requires further review.
• Gather relevant context and supporting evidence, apply sound judgment, and distinguish potentially risky activity from legitimate or personal activity where appropriate.
• Create and document investigation cases, then escalate validated cases to the deeper investigation team.
• Review activity involving potential data exfiltration, suspicious external sharing, unusual use of tools, policy violations , and other insider-risk indicators.

2. Insider Threat Detection and SIEM Analysis

• Review and analyze alerts and detections in the Palo Alto SIEM environment.
• Search and correlate logs to assess suspicious activity and investigate security events.
• Review existing detection logic and recommend tuning to improve detection quality and reduce false positives.
• Support the maintenance and improvement of queries, dashboards, automation, and investigation workflows .
• Use query-based analysis to identify patterns, validate detections, and provide recommendations for improvement.

Key Responsibilities

• Monitor insider-risk and security alerts generated by Microsoft Purview and other relevant security tools.
• Analyze user activity, authentication events, endpoint activity, and security logs to validate suspicious behavior.
• Recognize potential data theft or exfiltration, unauthorized access, misuse of privileges, policy violations , and suspicious use of applications or tools.
• Correlate information across systems and use contextual judgment to determine whether an alert should be documented, closed, or escalated.
• Gather supporting evidence and maintain clear, accurate case documentation.
• Escalate validated cases to the appropriate team for deeper investigation; this role does not necessarily own end-to-end investigations.
• For SIEM-focused work, review detections, develop or refine queries, and recommend tuning or dashboard improvements.
• Support automation and continuous improvement of monitoring and investigation workflows where appropriate.
• Work collaboratively with cybersecurity, threat intelligence, and relevant partner teams.

Qualification Criteria

Required Skills and Experience

• BE / BTech with 5-8 years of experience with strong Foundational cybersecurity experience in a SOC, security monitoring, cybersecurity analysis, incident response, threat hunting, or a related role.
• Experience reviewing security alerts and investigating or validating suspicious activity; candidates should demonstrate an investigative mindset rather than only passive alert monitoring.
• Hands-on exposure to SIEM tools and the ability to review alerts, search logs, and correlate security events. Relevant platforms may include Palo Alto, Splunk, Microsoft Sentinel, QRadar, Cortex , or comparable tools.
• Log analysis experience, including security, authentication, endpoint, or user activity logs.
• Working knowledge of Windows and Linux operating systems; macOS exposure is beneficial.
• Understanding of networking fundamentals, including TCP/IP, DNS , and common security-related communications.
• Ability to use judgment, document findings clearly, and follow appropriate escalation processes.

Preferred Skills

• Direct experience with Microsoft Purview Insider Risk Management or an Insider Threat Program .
• SQL or other query-writing experience for security event and log analysis.
• XQL experience, particularly for Palo Alto SIEM detection analysis.
• PowerShell or Python scripting for investigation support, log parsing, or automation. Scripting is beneficial but is not a strict screening knockout.
• Detection tuning, dashboard improvement, security analytics, or threat hunting experience.
• Digital forensics, evidence collection and preservation, cloud security, behavioral analytics , and familiarity with MITRE ATT&CK .

Additional Information

Role Context and Candidate Calibration

• The triage-focused profile is centered on daily alert review, validation, evidence gathering, and case creation.
• The SIEM-focused profile requires stronger query and detection-analysis capability, including reviewing and tuning detections.
• The role is part of a broader team; deeper investigations are handed over to the relevant investigation group.

Microsoft Purview is the primary tool for current insider-risk monitoring, and Palo Alto is used for SIEM detections.

#Cybersecurity #InsiderThreat #InsiderRiskManagement #MicrosoftPurview #PaloAlto #SIEM #SOCAnalyst #SecurityAnalyst #ThreatDetection #IncidentResponse #ThreatHunting #SecurityMonitoring #LogAnalysis #DataExfiltration #CyberSecurityJobs #CyberSecurityCareers #HiringNow #HyderabadJobs #HyderabadHiring #JobsInHyderabad #HyderabadITJobs #HyderabadCareers #TelanganaJobs #CybersecurityHiring