Insider Threat Monitoring Lead (CBP)

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission hold sensitive law enforcement and personal data, and the people with legitimate access to it are, by definition, trusted. Most of the damage an insider threat program exists to catch does not come from a sophisticated outside attacker. It comes from someone who already has the access, and the work is telling the difference between normal use and misuse without treating every employee as a suspect. You lead that function. You will build and run the monitoring, analysis, and escalation process that catches insider risk early, working closely with the Security Operations Center Manager, human resources and security partners, and the incident response and digital forensics leads when a case moves from monitoring to action.

Responsibilities

Lead the insider threat monitoring, analysis, and escalation process for CBP; Build and run monitoring, analysis, and escalation process that catches insider risk early; Work closely with the Security Operations Center Manager, human resources and security partners, and incident response and digital forensics leads when a case moves from monitoring to action; Catch real insider risk without drowning in noise; Run the program in a way people can trust is fair; Hand off cleanly when a case becomes something else; Improve what the program watches for over time

Requirements

Active Top Secret with SCI Eligibility and ability to obtain CBP Background Investigation (CBP BI) and EOD; U.S. Citizenship required; Active CISSP; Minimum of five (5) years of professional experience leading the cyber component of an insider threat program; In-depth understanding of the principles, methodologies, and best practices for establishing, operating, and maturing an insider threat program; Bachelor's degree in computer science, Engineering, STEM, Information Technology, or Cybersecurity

Nice to have

Active BI strongly preferred; Experience as a senior analyst or running an insider threat program, ideally in a federal or cleared environment where NITTF-aligned or equivalent standards applied; Experience handling a case involving coordination with HR, legal, or security partners; Experience tuning detection logic based on real case outcomes; Ability to explain sensitive findings to people outside the program without oversharing; Active CBP BI, a fitness determination at another DHS component, or an active DoD clearance; Comfort working closely with human behavior data and understanding privacy and legal boundaries; Counter-intelligence experience; Digital Forensics and related certifications; User Activity Monitoring (UAM); User Behavior Analytics (UBA)

Benefits

Health Insurance; Life Insurance; Paid Time Off; Holiday Pay; short-term and long-term Disability; Retirement; Learning and Development opportunities; other optional benefit elections; $10,000 signing bonus for candidates with an active CBP BI, payable after 90 days with standard terms applicable