> Markdown version of [/jobs/ext/1250038-lead-cybersecurity-insider-risk-analyst-telemetry-insider-risk-detection-and-ai-driven-security-operations](https://www.wearedevelopers.com/jobs/ext/1250038-lead-cybersecurity-insider-risk-analyst-telemetry-insider-risk-detection-and-ai-driven-security-operations). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Cybersecurity - Insider Risk Analyst (Telemetry, Insider Risk Detection, and AI-Driven Security Operations) - **Company:** AT&T Inc. - **Location:** New York, NY, United States - **Experience:** Expert - **Salary:** $141,300.0 - $211,900.0 - **Contract:** Temporary to permanent - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Artificial Intelligence, Data Analysis, Apple Mac Systems, Bash Shell, Software as a Service, Cloud Computing Security, Software Documentation, Cyber Security, Data Deduplication, Intrusion Detection and Prevention, Virtual Private Networks (VPN), Python (Programming Language), Linux System Administration, Network Forensics, Network Protocols, Windows PowerShell, Cloud Services, Security Information and Event Management, Systems Integration, Scripting, Cloud Platform System, Mitre Att&ck, Cyber Threat Analysis, Tanium Platform Expertise, Information Technology, Splunk - **Published:** July 12, 2026 - **Apply:** https://www.careerjet.com/job/usacc39eca14408ebf0e140dfae2eaa8a4/eaa ## About the Role This position requires office presence of a minimum of 5 days per week and is only located in the location(s) posted. No relocation is offered., * 5+ years of hands-on cybersecurity experience in incident response, security operations, insider risk, threat detection, or a closely related function. * Demonstrated experience leading or handling escalated incidents, including triage, investigation, containment, remediation, and post-incident reporting in complex enterprise environments. * Proficiency with security telemetry and investigation workflows across endpoint and network data sources; experience using SIEM analytics (e.g., Splunk) and EDR tooling. * Working knowledge across multiple domains such as host analysis, network forensics, cloud environments, UEBA/anomaly detection, intrusion detection, threat research/intelligence, detection engineering, and data analysis. * Ability to develop or maintain automation using scripting (e.g., Python, PowerShell, Bash) and/or APIs to improve security operations. * Strong written and verbal communication skills, including the ability to produce executive-ready summaries and lead discussions with technical and non-technical stakeholders. * Demonstrated integrity and discretion in handling sensitive investigations and confidential data. Preferred Qualifications * Experience with Tanium (or comparable endpoint management/telemetry platforms) and building integrations across enterprise security tools. * Experience implementing automation or orchestration in security operations (SOAR, APIs, pipelines, scripted workflows) to accelerate response and improve consistency. * Experience applying AI-assisted analytics for alert enrichment, correlation/deduplication, prioritization, and operational reporting. * Experience with insider risk programs, user/entity behavior analytics (UEBA), and behavior-based detection strategies. * Experience investigating and responding to threats in cloud and SaaS environments. * Experience mentoring analysts and contributing to training, playbooks, and tabletop exercise development. * Relevant industry certifications (e.g., GCIA, GCIH, GCFA, CISSP, or equivalent) and/or a bachelor's degree in a related field. Education/Experience: Bachelor's degree (BS/BA) desired in Computer Science or Cybersecurity. 5+ years of related experience. Certification is required in some areas. Supervisor ## Description The Lead Cybersecurity Insider Risk Analyst leads the response to high-priority and escalated cybersecurity incidents, with a focus on insider risk and telemetry-driven detection. This role oversees end-to-end incident handling-including detection, analysis, containment, eradication, recovery, reporting, and prevention-across employees, contractors, and third-party vendors. The position also drives continuous improvement through development of new detection logic, micro-hunts, and the integration of automation and AI-assisted analytics to increase detection fidelity and reduce manual effort. Success in this role requires advanced technical depth, strong operational rigor, and the ability to communicate clearly with both technical teams and executive stakeholders. Key Roles and Responsibilities * Incident leadership: Serve as lead handler for escalated insider risk and cyber incidents; establish investigation strategy, ensure timely execution, and drive incident closure. * Advanced investigation and triage: Conduct deep-dive analysis of security events using telemetry, endpoint/network evidence, and threat intelligence to determine scope, impact, and root cause. * Detection engineering and continuous improvement: Create, tune, and deploy new detection rules and analytics aligned to evolving threats and suspicious behaviors; reduce false positives and improve signal-to-noise. * Micro-hunts and threat intelligence: Perform targeted hunts to discover emerging behaviors and translate findings into actionable detections, controls, and playbooks. * Remediation and containment: Partner with IT and security stakeholders to drive containment, remediation, and recovery actions across endpoints, identities, and cloud services. * Process and program maturity: Contribute to incident response process improvements, documentation standards, and after-action reviews; support development of tabletop exercise scenarios. * Executive communication: Produce clear, concise updates for leadership (status, impact, risk, and next steps) and deliver required incident reports and post-incident summaries. * Mentorship and SME support: Coach and mentor analysts in triage and investigation practices; serve as a subject matter expert across the incident response organization. Integrations, Automation, and AI-Driven Security Operations * Build and maintain integrations between multiple enterprise security tools to improve automation, asset inventory accuracy, vulnerability identification, and response workflows. * Implement AI-assisted monitoring and analytics to improve correlation, enrichment, prioritization, and triage of alerts; reduce manual effort and improve time to decision. * Develop and maintain risk-scoring approaches for endpoints and users based on security posture, vulnerabilities, and behavioral signals. * Produce trend analyses and operational health reporting (e.g., coverage, agent health, patch/compliance drift, and incident patterns) and translate results into improvement actions. * Develop and maintain automation via APIs, scripting, and orchestration to support agent deployment/upgrade workflows, compliance checks and remediation, rapid scoping, containment support, targeted remediation, and continuous control validation. Technical Scope * Use case management platforms, endpoint/network telemetry, and threat intelligence sources to investigate, document, and resolve incidents. * Apply incident handling methodologies and attack frameworks (e.g., kill chain / MITRE ATT&CK-aligned thinking) to guide response and reporting. * Perform in-depth analysis of threats, exploits, vulnerabilities, and malware families; validate hypotheses using host and network evidence. * Conduct investigations across Windows, macOS, and Linux environments. * Leverage Endpoint Detection and Response (EDR) tooling and cloud security telemetry to scope activity and support containment/remediation actions. * Use Splunk and related analytics tooling to query, correlate, and operationalize security data for investigations and reporting. * Demonstrate strong understanding of enterprise infrastructure and connectivity (e.g., VPN/partner connectivity) and common network protocols. * Design, implement, and tune security detections in response to emerging threats and insider risk behaviors. * Develop scripts and automation (e.g., Python, PowerShell, Bash) to enrich investigations and streamline operational workflows. * Collaborate with partner analytic and engineering teams to align detections, telemetry, and response actions across the broader security ecosystem. ## Related Videos - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Old tools, new tricks](https://www.wearedevelopers.com/videos/1916-old-tools-new-tricks) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [MCP doesn’t suck — your agent does](https://www.wearedevelopers.com/videos/100202-mcp-doesn-t-suck-your-agent-does) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)