Insider Threat Technical Lead

Position Overview

9th Way Insignia is seeking a hands-on Insider Threat Technical Lead to serve as the technical lead for an established Insider Risk program supporting the United States Patent and Trademark Office (USPTO). This is an individual-contributor technical leadership role — not a management position. You will be the senior technical voice on a small delivery team, guiding insider-risk analysts, advising government data owners and program leadership, and personally building and tuning the Microsoft security tooling the program runs on.

What You Will Do

• Serve as the insider-risk technical lead and trusted advisor to USPTO stakeholders: run regular customer syncs, deliver polished status reporting, and proactively bring emerging requirements (CISA directives, NIST guidance, AI policy) to the customer with an implementation path.
• Own the technical direction of the insider-risk toolset in Microsoft Purview: Insider Risk Management policies, indicators, trigger events, sequence detection, privacy/anonymization settings, role groups and permissions, DLP, sensitivity labels and auto-labeling, eDiscovery/legal holds, and unified audit log analysis.
• Design and maintain custom dashboards, workbooks, and playbooks in Microsoft Sentinel; work across the program’s additional SIEMs (QRadar, Splunk) and custom Microsoft UBA rule engines; investigate and triage insider-risk alerts alongside the analysts and guide them on findings.
• Build, edit, and troubleshoot Power Automate flows that drive program automation (the program currently operates 50+ production flows), using KQL, JSON, and YAML.
• Advise the customer on securing Microsoft 365 Copilot adoption: Purview Data Security Posture Management, permission and sharing remediation, restricted content discovery, acceptable-use and DLP policy alignment, and NIST AI RMF alignment.
• Define, track, and brief insider-risk program KPIs to leadership (alert volume and fidelity, true/false positive rates, MTTD/MTTR, repeat offenders, exfiltration channels, departmental trends) and recommend program improvements.
• Mentor and technically guide the program’s insider-risk analysts; answer their questions on data findings and investigation paths.
• Operate effectively in an environment where backend administration is held by government teams: the program performs front-end policy configuration and monitoring, and works through USPTO administrators for backend changes. Patience and influence without direct admin access are essential.

Required Qualifications

• Bachelor's degree from an accredited institution in Information Technology, Computer Science, Information Systems Management, Cybersecurity, or a related field.
• Seven (7) years of specialized experience in one or more of the following: Cyberspace Operations, Network Security, Computer Forensics, Network Forensics, Computer Network Defense (CND), Attack Sensing & Warning (AS&W), Intelligence Analysis, Cyber Threat Hunting, Penetration Testing, Insider Threat Detection/Mitigation, or Incident Detection & Response. Candidates holding a Master's degree from an accredited institution in information technology, information assurance, information systems management, cybersecurity, or a related field may substitute that degree for two (2) years of experience, reducing the requirement to five (5) years of specialized experience.
• Primary certification — must currently hold one (1) of: CISSP or GIAC Security Expert (GSE).
• Secondary certification — in addition to the primary certification above, must currently hold one (1) or more of: GIAC Certified Detection Analyst (GCDA); GIAC Certified Intrusion Analyst (GCIA); GIAC Certified Forensic Analyst (GCFA); GIAC Cyber Threat Intelligence (GCTI); GIAC Network Forensic Analyst (GNFA); GIAC Penetration Tester (GPEN); GIAC Reverse Engineering Malware (GREM).
• Active SECRET clearance, or the ability to obtain and maintain one.