Center 3 (19075), United States of America, McLean, Virginia

Insider Threat Exit Risk Analyst

Capital One is looking for an Insider Threat Analyst to join the Cyber Insider Threat and Technical Investigations program. As an Insider Threat Analyst in our Exit Risk Mitigation (XRM) team, you will perform monitoring, triage and analysis, and investigation of departing associates exhibiting anomalous behavior, using a wide variety of security tools across multiple environments to identify, mitigate, and escalate potential insider threats for further investigation. Candidates should be able to manage case workflows, document analyses and investigative findings, formulate escalation reports, and exercise attention to detail and discretion in sensitive investigative matters. Candidates should also thrive in a cross-functional and dynamic environment, where coordination with partner teams and stakeholders is required.

• Triage activity data of an identified exiting population against insider threat alerts and referrals from partner Insider Threat (IT) and Data Loss Prevention (DLP) SecOps teams, other Cyber teams, and partners and stakeholders in HR, the Office of Corporate Investigations (OCI), Legal, and others
• Track and document investigations from initial detection or referral through escalation or resolution
• Utilize insider threat tools and cyber logging across several platforms to investigate insider threats and escalate to appropriate stakeholders including the Insider Threat Investigations team, OCI, and Legal as appropriate
• Follow investigative processes and procedures, exercising attention to detail and sound technical, interpersonal, and organizational judgment
• Effectively communicate with stakeholders and partner teams to ensure timely scoping, evidence collection, case coordination, and escalation
• Present case artifacts and findings in informal meetings with other Insider Threat analysts and investigators
• Exercise discretion and professionalism when conducting associate-based investigations and inquiries
• Develop, follow, and maintain process 'playbooks' of various operational investigative workflows
• Identify trends, gaps, and opportunities for process and alert improvement, raising these issues to team leads for resolution

• High School Diploma, GED, or equivalent certification
• At least 1.5 years of experience in the cyber security
• At least 1.5 years of experience in threat analysis
• At least 1.5 years of experience in analyzing information and data
• At least 1.5 years of experience in Data Loss Prevention (DLP), incident management, or investigative programs
• At least 1.5 years of experience in technical troubleshooting and anomaly detection

• Bachelor's Degree
• 3+ years of experience in the cyber or threat analysis field
• 3+ years of experience in understanding and communicating Data Loss Prevention (DLP) concepts, trends, people risk, or conduct risk program management
• 2+ years of experience in writing automated processes in Python, Bash, or Powershell to query various data sources
• Familiarity with task management tools such as JIRA and Kanban
• CFCE, CCE, GCIA, GCIH, Security+, CFCE, EnCE, or CISSP