Note: The job is a remote job and is open to candidates in USA. CVS Health is a healthcare company focused on creating a more connected, convenient, and compassionate health experience. The Senior Security Engineer - Insider Risk investigates potential insider threats, conducts digital forensics and incident response activities, analyzes security data, and partners with HR, Legal, Corporate Security, and cybersecurity teams to mitigate risks.
Responsibilities
- Conduct insider risk investigations, build investigative timelines, support interviews, and document findings in partnership with HR, Legal, Corporate Security, and cybersecurity stakeholders
- Independently manage routine investigations and support senior analysts on complex or high-sensitivity matters involving employees, contractors, vendors, or other trusted insiders
- Triage and correlate data across SIEM, EDR, DLP, UBA, email security, and other investigative tools to identify and assess potential insider risk activity
- Perform digital forensic analysis on Windows, macOS, Android, and iOS devices
- Prepare clear, factual reports and status updates for technical and non-technical stakeholders
- Maintain accurate case documentation, evidence handling procedures, and chain of custody requirements
- Partner with SOC, Corporate Security, Legal, HR, and business teams to support investigations and risk mitigation activities
- Support efforts to reduce insider risk by identifying trends, recommending corrective actions, and contributing to improvements in detection, investigation, and response capabilities
- Participate in an on-call schedule to support urgent investigations and incident response activities
Skills
- 5+ years of relevant experience in information security and related technologies
- 3+ year in digital forensics, incident response, or insider risk investigations related functions
- 1+ years of experience with evidence handling, chain of custody, and modern digital forensic tooling (e.g., Axiom, VeraKey, ITR RECON)
- Minimum of at least 2 DoD 8140 active certifications (e.g., Network+ CE, GSEC, SSCP) with at least 1 Intermediate / Level 2 technical (e.g., SSCP, GSEC, CySa+ Security+ CE)
- Bachelor's degree from an accredited college or university, or equivalent combination of education and relevant work experience (High School Diploma/GED plus 4 years of related experience)
- Hands-on experience with one or more SIEM platforms (e.g., Splunk, Sentinel, Chronicle) and query language proficiency
- Hands-on experience with EDR and DLP tooling
- Working knowledge of common attacker techniques, log sources, and endpoint indicators of compromise
- Exposure to Insider Risk Management (IRM) or User Behavior Analytics (UBA) platforms
- Experience supporting investigations alongside HR, Legal, or Corporate Security
- Ability to handle sensitive, confidential matters with discretion and sound judgment
- Training or coursework in investigative interviewing techniques
- Strong written and verbal communication skills, including the ability to document findings clearly for non-technical audiences
- Industry certifications such as SANS/GIAC GCFE, GCIH, GCFA, GASF, CySA+, CASP+, CISSP
Benefits
- This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above.
- Medical coverage, based on eligibility.
- Dental coverage, based on eligibility.
- Vision coverage, based on eligibility.
- Paid time off, based on eligibility.
- Retirement savings options, based on eligibility.
- Wellness programs, based on eligibility.
- Other resources supporting the physical, emotional, and financial well-being of colleagues and their families, based on eligibility.
Company Overview
Company H1B Sponsorship