Insider Risk Security Engineer

Zscaler is a cloud security company focused on helping organizations securely connect users, devices, and applications through its Zero Trust Exchange platform. The Insider Risk Security Engineer will serve as a senior contributor on the Insider Risk program, refining detection capabilities, conducting endpoint and user activity investigations, developing investigation playbooks, and collaborating with HR, Legal, business leaders, and executive stakeholders.

Responsibilities:

• Sharpen the Insider Risk Program’s detection capabilities by refining rules to reduce noise, close coverage gaps, and surface high-fidelity alerts in adequate time
• Perform endpoint and user activity investigations using EDR/XDR, UEBA, and SIEM tools, managing cases end-to-end to create factual timelines
• Drive the development and iteration of insider Risk investigation playbooks, translating case patterns and lessons learned into scalable, defensible processes
• Serve as a key contact for HR, Legal, business leaders and other stakeholders on active investigations, preparing clear evidentiary case documentation

Requirements:

• Foundational understanding of AI/ML technologies and experience leveraging, securing, or positioning AI-driven solutions to optimize outcomes within your functional domain
• U.S. Citizenship required
• Minimum 6+ years of experience in insider risk, data protection, fraud investigation, or security operations, with a proven track record in senior investigative roles, process ownership, and the design of detection frameworks and playbooks
• Experience managing and dispositioning alerts within a SIEM or SOAR
• Strong communication skills with proven ability to engage cross-functionally with HR, Legal, business leaders, and other stakeholders while maintaining discretion and sound judgment
• Proficiency in Python or JavaScript with experience applying automation to investigative workflows
• Demonstrated curiosity and active exploration of AI tools, with a proven history of integrating new technologies to enhance daily workflows and augment problem-solving
• Hands-on experience with Zscaler's product portfolio (CyberRisk Protection, Data Protection, Zero Trust Networking) in a large-scale enterprise environment
• Experience working with product development teams to implement security use cases
• Relevant certifications (e.g., GCFA, GCFE) or equivalent forensics credentials; familiarity with industry frameworks (CERT, NIST)