Insider Risk Security Engineer

Experience: 5–10 Years

Domain: Banking / Financial Services

Job Type: Full-Time

Location: Hyderabad (Onsite)

Function: Information Security / Insider Risk

Role Overview

We are looking for an experienced Insider Risk Security Engineer to join our banking client’s Information Security team. The role will focus on identifying, investigating, and mitigating insider threat and insider risk activities, including data exfiltration, unauthorized data access, inappropriate use of corporate resources, and suspicious user behavior.

The candidate will work closely with Incident Response, DLP, Legal, Privacy, HR, Compliance, and business data owners to investigate insider risk cases, develop detection capabilities, strengthen monitoring controls, and protect sensitive and regulated information.

Key Responsibilities

• Insider Risk Investigation and Incident Response
• Act as a Tier 2/Tier 3 escalation point for Insider Risk alerts and investigations.
• Investigate potential insider threats, including:
• Data exfiltration
• Unauthorized access to sensitive information
• Suspicious file and data movement
• Use of unauthorized applications or services
• Abnormal user behavior
• Policy violations
• Risky employee activity
• Analyze user behavior and security telemetry to identify indicators of insider risk and potential malicious or negligent activity.
• Coordinate investigation, containment, remediation, and response activities with Incident Response, DLP, and other security teams.
• Investigate and manage Insider Risk alerts and cases while maintaining appropriate confidentiality and access controls.
• Support case documentation, evidence collection, investigation timelines, findings, and remediation recommendations.
• Security Monitoring and Threat Hunting
• Correlate Insider Risk signals with DLP alerts, sensitivity labels, identity activity, endpoint activity, authentication events, file activity, and Microsoft 365 activity.
• Contribute Insider Risk telemetry and investigation findings to enterprise threat detection and monitoring programs.
• Develop and optimize KQL queries using Microsoft Defender XDR Advanced Hunting and Microsoft Purview audit and activity logs.
• Perform proactive threat hunting to identify suspicious user behavior, data access patterns, and potential exfiltration activities.
• Develop and maintain custom analytics, detection logic, dashboards, workbooks, and investigation queries for Insider Risk monitoring.
• Identify behavioral patterns and risk indicators to improve Insider Risk detection and prevention capabilities.
• Microsoft Purview Insider Risk Management
• Design and recommend tuning for Microsoft Purview Insider Risk Management policies.
• Configure and tune risk indicators, detection policies, thresholds, alerts, and risk-scoring mechanisms.
• Recommend improvements to existing Insider Risk detection, monitoring, investigation, and response capabilities.
• Support Insider Risk requirements related to AI and GenAI usage, including identifying risky user behavior and unauthorized transfers of sensitive information to AI platforms.
• Stay current with developments in Microsoft Purview Insider Risk Management, AI-driven threat detection, behavioral analytics, GenAI security, and insider threat technologies.
• Reporting, Metrics, and Documentation
• Develop metrics and dashboards covering:
• Insider Risk alert volumes
• Risk trends
• Investigation volumes
• High-risk activity
• False-positive rates
• Case closure trends
• Policy effectiveness
• Detection coverage
• Prepare metrics and reports for security leadership, audit, risk, compliance, privacy, and governance stakeholders.
• Maintain runbooks, standard operating procedures (SOPs), investigation procedures, architecture documentation, and knowledge repositories for Insider Risk operations.
• Cross-Functional Collaboration and Compliance
• Partner with Legal, Privacy, HR, Compliance, Risk, and business data owners to ensure Insider Risk controls align with organizational policies and regulatory requirements.
• Support investigations involving sensitive employee and customer information while following applicable privacy, legal, and data-handling requirements.
• Partner with DLP teams to strengthen controls around data exfiltration and unauthorized data movement.
• Contribute to the continuous improvement of Insider Risk operations and enterprise secur