Insider Risk Security Engineer

Job Description – Insider Risk Security Engineer

• Experience: 5–10 Years

• Domain: Banking / Financial Services

• Job Type: Full-Time

• Location: Hyderabad / Onsite

• Function: Information Security / Insider Risk

Role Overview

We are looking for an experienced Insider Risk Security Engineer to join our banking client’s Information Security team. The role will focus on identifying, investigating, and mitigating insider threat and insider risk activities, including data exfiltration, unauthorized data access, inappropriate use of corporate resources, and suspicious user behavior.

The candidate will work closely with Incident Response, DLP, Legal, Privacy, HR, Compliance, and business data owners to investigate insider risk cases, develop detection capabilities, strengthen monitoring controls, and protect sensitive and regulated information.

Key Responsibilities

• Act as a Tier 2/Tier 3 escalation point for Insider Risk alerts and investigations.

• Investigate potential insider threats, including:

  • Data exfiltration

  • Unauthorized access to sensitive information

  • Suspicious file and data movement

  • Use of unauthorized applications or services

  • Abnormal user behavior

  • Policy violations

  • Risky employee activity

• Analyze user behavior and security telemetry to identify indicators of insider risk and potential malicious or negligent activity.

• Coordinate investigation, containment, remediation, and response activities with Incident Response, DLP, and other security teams.

• Correlate Insider Risk signals with DLP alerts, sensitivity labels, identity activity, endpoint activity, authentication events, file activity, and Microsoft 365 activity.

• Contribute Insider Risk telemetry and investigation findings to enterprise threat detection and monitoring programs.

• Develop and optimize KQL queries using Microsoft Defender XDR Advanced Hunting and Microsoft Purview audit/activity logs.

• Perform proactive threat hunting to identify suspicious user behavior, data access patterns, and potential exfiltration activities.

• Develop and maintain custom analytics, detection logic, dashboards, workbooks, and investigation queries for Insider Risk monitoring.

• Identify behavioral patterns and risk indicators that can be used to improve Insider Risk detection and prevention capabilities.

• Design and suggest tuning to maintain Microsoft Purview Insider Risk Management policies.

• Configure and tune risk indicators, detection policies, thresholds, alerts, and risk scoring mechanisms.

• Investigate and manage Insider Risk alerts and cases while maintaining appropriate confidentiality and access controls.

• Support case documentation, evidence collection, investigation timelines, findings, and remediation recommendations.

• Develop metrics and dashboards covering:

  • Insider Risk alert volumes

  • Risk trends

  • Investigation volumes

  • High-risk activity

  • False-positive rates

  • Case closure trends

  • Policy effectiveness

  • Detection coverage

• Prepare metrics for security leadership, audit, risk, compliance, privacy, and governance stakeholders.

• Maintain runbooks, SOPs, investigation procedures, architecture documentation, and knowledge repositories for Insider Risk operations.

• Partner with Legal, Privacy, HR, Compliance, Risk, and business data owners to ensure Insider Risk controls align with organizational policies and regulatory requirements.

• Support investigations involving sensitive employee and customer information while following applicable privacy, legal, and data-handling requirements.

• Partner with DLP teams to strengthen controls around data exfiltration and unauthorized data movement.

• Support Insider Risk requirements related to AI and GenAI usage, including identification of risky user behavior and unauthorized transfer of sensitive information to AI platforms.

• Stay current with developments in Microsoft Purview Insider Risk Management, AI-driven threat detection, behavioral analytics, GenAI security, and insider threat technologies.

• Recommend improvements to existing Insider Risk detection, monitoring, investigation, and response capabilities.

Banking / Enterprise Security Experience

• Experience working in a large enterprise or regulated environment, preferably Banking, Financial Services, Insurance, or FinTech.

• Understanding of risks associated with PII, financial information, customer data, confidential information, intellectual property, and regulated data.

• Experience handling sensitive employee and customer information during security investigations.

• Understanding of privacy, compliance, audit, and regulatory requirements relevant to Insider Risk programs.

• Experience working with SOC, IR, DLP, Legal, HR, Privacy, Compliance, and Risk teams.

Preferred Skills

• Microsoft Purview Insider Risk Management.

• Microsoft Purview DLP and Information Protection.

• Microsoft Defender XDR.

• UEBA / behavioral analytics.

• SIEM/SOAR platforms.

• Identity and access management telemetry.

• Endpoint Detection and Response (EDR).

• Cloud and SaaS security.

• AI/GenAI security and GenAI data governance.

• Experience developing Insider Risk dashboards and executive-level reporting.

Soft Skills

• Strong analytical and investigative skills.

• Ability to analyze complex user behavior and security events.

• Strong attention to detail and evidence-based investigation approach.

• Ability to handle highly confidential security investigations.

• Strong communication and stakeholder-management skills.

• Ability to collaborate with technical and non-technical stakeholders.

• Strong documentation and reporting capabilities.

• Ability to work effectively in a high-priority, regulated banking environment.