Pueo is seeking a driven Insider Threat Signature Developer to join our unique team of multidisciplined experts onsite in the National Capital Region (NCR), to work closely with our IC customer stakeholders in identifying critical assets, potential threat vectors, evaluating and recommending security technologies to improve the organization's insider threat posture.

In this role you will serve as a specialized security professional responsible for designing, implementing, and maintaining behavioral and rule-based signatures to detect insider threats. You will collaborate with threat intelligence, security operations, and engineering teams to translate risk insights into actionable rules and automated responses. 

The Insider Threat Signature Developer will be responsible for the following, but not limited to:

Detection Engineering

• Design, implement, and maintain insider threat detection signatures tailored to organizational data, user behavior, and access patterns, translating threat intelligence, threat modeling scenarios, and incident learnings into measurable, testable signals.
• Validate and test signatures in controlled environments, continuously refining signatures to reduce false positives.
• Document detection logic, data sources, and tuning parameters, and maintain versioned signature libraries with change tracking and rollback plans.
• Collaborate with Insider Threat Program (ITP) stakeholders to align signatures with policies, acceptable use guidelines, and incident response playbooks.

Incident Response and Performance Analysis

• Participate in incident investigations, providing signature-based evidence, alert analysis, and analytics.
• Conduct root cause analysis, recommend corrective actions, and support remediation to prevent recurrence.
• Develop and track KPIs to measure detection effectiveness, and produce regular reports highlighting trends, insights, and recommended improvements.

Compliance and Audit

• Ensure all detection activities comply with applicable regulations and standards, including CNSS, ICDs, industry-specific requirements, and privacy, legal, and data protection obligations.
• Participate in internal and external audits, providing evidence of compliance and the effectiveness of insider threat triggers.

Minimum Required Qualification:  

• Must have a current/active TS/SCI with the ability to obtain and maintain a CI Poly.
• Masters in a related field and 6 years of relevant experience, or a bachelors in a related field and 8 years of relevant experience, or an associates and 10 years of relevant experience, or 12 years of relevant experience in lieu of a completed degree.
• Must possess one of the following IAT III Certification in compliance with DoD 8570.01-M and DoD Directive 8140 Cyberspace Workforce Management. (ex; CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP).
• Must possess a strong analytical and investigative mindset. 
• Insider threat domain knowledge and experience in regulatory adherence, audits and reviews, incident investigations, root cause analysis, and remediation.
• Experience in Insider threat detection signatures and signature libraries. 
• Knowledge of IC and/or DoD Security Directives, Guidance, Policies and Procedures. 
• Knowledge or familiarity with DoD’s Risk Management Framework Manual.
• Experience drafting insider threat reports. Log analysis and threat intelligence skills.
• Solid interpersonal and communication skills to interact with various stakeholders and team members effectively.  

Desired Qualifications:   

• An active Top Secret security clearance with SCI eligibility and current CI poly.  
• Insider threat credentials such as the Certified Insider Threat Professional (CITP) or completion of CDSE Insider Threat Program Management courses. 
• Advanced certifications such as CISSP, GCIA, GCFA, or GCIH.
• Vendor certifications in the organization’s SIEM or UAM platforms. 
• Demonstrated experience designing, deploying, and tuning detection signatures or analytics in a SIEM or UEBA platform (e.g., Splunk, Microsoft Sentinel, Elastic, Exabeam).
• Knowledge or hands-on experience with insider threat or DLP tools such as DTEX, Forcepoint, Proofpoint ITM, Microsoft Purview, or Securonix.
• Hands-on experience in monitoring systems, SIEM, DLP, EDR, and behavioral analytics platforms.
• Experience applying MITRE ATT&CK, CERT Insider Threat Center models, and NITTF guidance to threat modeling and detection coverage mapping.
• Working knowledge of CNSSD 504, ICD 503, EO 13587, the National Insider Threat Policy and Minimum Standards, and NISPOM (32 CFR Part 117).
• Understanding of insider risk data sources, including endpoint, identity and access, email, web proxy, cloud, removable media, and HR data feeds.
• Proficiency in at least one query language (SPL, KQL, or SQL) and scripting experience in Python or PowerShell.
• Detection-as-code experience, including Git-based version control, CI/CD testing pipelines, and rollback processes for signature libraries. 

Salary Range Estimate: 

Min $100,744 – Max $161,958. The estimate displayed represents the typical salary range for this position and is just one component of Pueo’s total compensation package for employees. Other rewards may include annual bonuses, short- and long-term incentives, and program-specific awards. In addition, Pueo provides a variety of benefits to employees.

Pueo Overview: 

Pueo is a National Security cyber company built to inspect, defend, harden, and continuously authorize the networks our customers depend on. We deliver mission-grade cybersecurity across defense, intelligence, homeland security, federal enterprise, and critical infrastructure. Our work connects mission-risk inspection, defensive cyber operations, continuous authorization, security engineering, and mission delivery through one accountable team.

Pueo EEO Statement: 

Pueo is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. Pueo takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.