The Insider Threat Engineering Support Lead is a key role within the Cybersecurity Operations & Engineering team, focusing on internal human-risk factors and anomalous behavioral patterns. This position combines security engineering, data analytics, and behavioral threat hunting to enhance insider threat mitigation. The ideal candidate will possess both investigative and engineering skills to develop high-fidelity detections and proactively hunt for threats across large datasets. This role emphasizes the importance of understanding insider threats as distinct from external attacks.

• Strong understanding of core Cybersecurity and Insider Threat concepts.
• 6+ years of experience constructing, tuning, and executing complex queries within SIEM or log analytics platforms.
• Demonstrated ability to perform proactive, hypothesis-based threat hunting.
• Exceptional attention to detail with the ability to navigate and troubleshoot high-volume datasets.
• Demonstrated capability to independently manage workload and prioritize initiatives.

• Develop, test, tune, and maintain behavioral analytics and detection rules for insider threat vectors.
• Translate investigative insights into automated detection logic.
• Monitor detection effectiveness to minimize false positives.
• Conduct hypothesis-driven threat hunting across multi-source log repositories.
• Analyze large datasets to establish normal baseline activity and isolate anomalies.
• Support the end-to-end detection engineering lifecycle incorporating best practices.
• Participate in testing, validation, and continuous delivery of detection artifacts.
• Manage priorities autonomously in a fast-paced environment.

• Citi offers a comprehensive benefits package including competitive pay, stock programs, healthcare coverage, retirement plans, paid time off, parental leave, and programs supporting employee wellbeing and professional development.