Insider Threat Exit Risk Analyst

at  Capital One

Center 3 (19075), United States of America, McLean, Virginia
Insider Threat Exit Risk Analyst
Capital One is looking for an Insider Threat Analyst to join the Cyber Insider Threat and Technical Investigations program. As an Insider Threat Analyst in our Exit Risk Mitigation (XRM) team, you will perform monitoring, triage and analysis, and investigation of departing associates exhibiting anomalous behavior, using a wide variety of security tools across multiple environments to identify, mitigate, and escalate potential insider threats for further investigation. Candidates should be able to manage case workflows, document analyses and investigative findings, formulate escalation reports, and exercise attention to detail and discretion in sensitive investigative matters. Candidates should also thrive in a cross-functional and dynamic environment, where coordination with partner teams and stakeholders is required.

BASIC QUALIFICATIONS:

• High School Diploma, GED, or equivalent certification
• At least 1.5 years of experience in the cyber security
• At least 1.5 years of experience in threat analysis
• At least 1.5 years of experience in analyzing information and data
• At least 1.5 years of experience in Data Loss Prevention (DLP), incident management, or investigative programs
• At least 1.5 years of experience in technical troubleshooting and anomaly detection

PREFERRED QUALIFICATIONS:

• Bachelor’s Degree
• 3+ years of experience in the cyber or threat analysis field
• 3+ years of experience in understanding and communicating Data Loss Prevention (DLP) concepts, trends, people risk, or conduct risk program management
• 2+ years of experience in writing automated processes in Python, Bash, or Powershell to query various data sources
• Familiarity with task management tools such as JIRA and Kanban
• CFCE, CCE, GCIA, GCIH, Security+, CFCE, EnCE, or CISSP
  At this time, Capital One will not sponsor a new applicant for employment authorization, or offer any immigration related support for this position (i.e. H1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN, or another type of work authorization).
  Capital One offers a comprehensive, competitive, and inclusive set of health, financial and other benefits that support your total well-being. Learn more at the Capital One Careers website. Eligibility varies based on full or part-time status, exempt or non-exempt status, and management level.
  This role is expected to accept applications for a minimum of 5 business days.
  No agencies please. Capital One is an equal opportunity employer committed to diversity and inclusion in the workplace. All qualified applicants will receive consideration for employment without regard to sex (including pregnancy, childbirth or related medical conditions), race, color, age, national origin, religion, disability, genetic information, marital status, sexual orientation, gender identity, gender reassignment, citizenship, immigration status, protected veteran status, or any other basis prohibited under applicable federal, state or local law. Capital One promotes a drug-free workplace. Capital One will consider for employment qualified applicants with a criminal history in a manner consistent with the requirements of applicable laws regarding criminal background inquiries, including, to the extent applicable, Article 23-A of the New York Correction Law; San Francisco, California Police Code Article 49, Sections 4901-4920; New York City’s Fair Chance Act; Philadelphia’s Fair Criminal Records Screening Act; and other applicable federal, state, and local laws and regulations regarding criminal background inquiries.
  If you have visited our website in search of information on employment opportunities or to apply for a position, and you require an accommodation, please contact Capital One Recruiting at 1-800-304-9102 or via email at RecruitingAccommodation@capitalone.com. All information you provide will be kept confidential and will be used only to the extent required to provide needed reasonable accommodations.
  For technical support or questions about Capital One’s recruiting process, please send an email to Careers@capitalone.com
  Capital One does not provide, endorse nor guarantee and is not liable for third-party products, services, educational tools or other information available through this site.
  Capital One Financial is made up of several different entities. Please note that any position posted in Canada is for Capital One Canada, any position posted in the United Kingdom is for Capital One Europe and any position posted in the Philippines is for Capital One Philippines Service Corp. (COPSSC)

• Triage activity data of an identified exiting population against insider threat alerts and referrals from partner Insider Threat (IT) and Data Loss Prevention (DLP) SecOps teams, other Cyber teams, and partners and stakeholders in HR, the Office of Corporate Investigations (OCI), Legal, and others
• Track and document investigations from initial detection or referral through escalation or resolution
• Utilize insider threat tools and cyber logging across several platforms to investigate insider threats and escalate to appropriate stakeholders including the Insider Threat Investigations team, OCI, and Legal as appropriate
• Follow investigative processes and procedures, exercising attention to detail and sound technical, interpersonal, and organizational judgment
• Effectively communicate with stakeholders and partner teams to ensure timely scoping, evidence collection, case coordination, and escalation
• Present case artifacts and findings in informal meetings with other Insider Threat analysts and investigators
• Exercise discretion and professionalism when conducting associate-based investigations and inquiries
• Develop, follow, and maintain process ‘playbooks’ of various operational investigative workflows
• Identify trends, gaps, and opportunities for process and alert improvement, raising these issues to team leads for resolution