Cyber Security Analyst - Insider Risk

Motion Recruitment is recruiting for an unnamed large data and technology firm seeking a Cybersecurity Analyst to protect enterprise assets from insider threats. The role focuses on analyzing security telemetry, developing detection logic and automation, investigating potential incidents, and translating data into actionable intelligence.

Responsibilities:

• Synthesize and cross-examine massive data collections across SIEM, UEBA, and DLP platforms to pinpoint indicators of malicious, compromised, or accidental insider activity
• Design, test, and operationalize advanced detection queries and logic using languages such as YARA-L, SPL, and SQL to identify emerging threat behaviors
• Build custom automation scripts leveraging Python and PowerShell to accelerate data parsing, repetitive workflow execution, and alert enrichment
• Collaborate closely with incident responders, threat intelligence analysts, and investigations teams to conduct in-depth forensic analyses and contextualize potential insider incidents
• Engineer intuitive data visualizations and interactive dashboards to translate raw telemetry into actionable intelligence for technical teams and leadership
• Continuously evaluate detection efficacy, tune false-positive thresholds, and adapt hunting strategies to keep pace with evolving insider risk profiles

Requirements:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or an equivalent combination of education and hands-on industry experience
• 3 to 4+ years of professional experience in cybersecurity operations, insider threat management, threat hunting, or security data analytics
• Proven proficiency in querying, manipulating, and analyzing telemetry across enterprise SIEM, UEBA, and Data Loss Prevention (DLP) architectures
• Strong technical background in query development and correlation rule engineering utilizing SQL, SPL, or similar search syntaxes
• Hands-on scripting ability in Python or PowerShell for security automation, data pipeline extraction, and alert processing
• Firm understanding of Security Operations Center (SOC) workflows, modern incident handling frameworks, and forensic principles
• All applicants must be currently authorized to work on a full-time basis in the country for which they are applying, and no sponsorship is currently available
• Prior experience supporting enterprise-scale insider threat or data governance initiatives within a high-volume, regulated global network
• Direct operational experience with Google Security Operations (SecOps / Chronicle) and rule crafting in YARA-L
• Demonstrated success in engineering automated operational playbooks, SIEM workflows, and executive-level analytics dashboards
• Relevant industry certifications such as ITPM, GCITP, CISSP, GCIH, or related GIAC/SANS credentials