Insider Threat Engineer

Cloudflare

Insider Threat Tech Lead role at Cloudflare focused on investigations, threat hunting, and response strategies. Lead technical aspects of insider threat program and collaborate with teams.

Posted 7/15/2026full-timeAustin • Texas • 🇺🇸 United StatesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading insider threat investigations, utilizing advanced forensic tools and security technologies to analyze and respond to potential threats. Strong collaboration with cross-functional teams ensures compliance with legal and privacy standards while effectively communicating findings to stakeholders.

Highest-signal resume keywords

Insider Threat InvestigationsDigital ForensicsSecurity Information and Event Management (SIEM)Scripting and Programming (Python, PowerShell)Cross-Functional Collaboration

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital Evidence CollectionData AnalysisThreat HuntingIncident ResponseForensic Tools (EnCase, FTK, X-Ways)Security Technologies (Splunk, Elastic, CrowdStrike, SentinelOne)Rule DevelopmentResponse Playbook DevelopmentData CorrelationTechnical Investigation Leadership

Soft Skills

Excellent Communication SkillsProfessional PresentationRelationship BuildingSensitivity to PrivacyObjective Reporting

Tools & Technologies

Security Information and Event Management (SIEM)Data Loss Prevention (DLP)Endpoint Detection and Response (EDR)User and Entity Behavior Analytics (UEBA)Forensic Tools

Industry Keywords

Insider ThreatDigital InvestigationsRegulatory ComplianceLegal RequirementsPrivacy Standards

Tech Stack

Tools & technologies

CloudPythonSplunk

About the role

Key responsibilities & impact

Lead Insider Threat Digital Investigations
Conduct comprehensive technical investigations individually and partnering with our incident response teams into potential insider threat incidents, including data exfiltration, intellectual property theft, unauthorized access, and other malicious activities.
Knowledge and execution experience in collecting, preserving , and analyzing digital evidence from a variety of sources (e.g., endpoints, network logs, cloud services, email, etc.).
Document all investigative steps and findings in a clear, concise, and defensible manner.
Present findings to senior leadership and cross-functional partners (Legal, HR, Privacy) in a professional and objective manner.
Ensuring regulatory, legal and privacy requirements are met through all
Insider Threat Hunting
Proactively hunt for insider threats using a variety of security tools and data sources (e.g., SIEM, DLP, EDR, UEBA).
Develop and execute threat hunting hypotheses based on emerging threats, attack techniques, and an understanding of our company's unique environment.
Correlate disparate data points to identify anomalous or suspicious user behaviors.
Detection & Response Improvement
Collaborate closely with the Security Incident Response Team (SIRT) and Threat Detection teams to continuously enhance our insider threat detection capabilities.
Design, develop, and implement new rules, alerts, and use cases in our security tools to identify insider threat indicators.
Evaluate and recommend new technologies and processes to mature our Insider Threat program.
Develop and refine response playbooks for various insider threat scenarios.
Cross-Functional Collaboration
Serve as the primary technical liaison for the Insider Threat program, building strong, trusted relationships with Legal, HR, and Privacy teams.
Work in lockstep with these teams to ensure that investigations are conducted with sensitivity, respect for employee privacy, and within legal and ethical guidelines.
Provide technical expertise and guidance during policy development and incident response planning.

Requirements

What you’ll need

5+ years of experience in a technical security role, with at least 2+ years focused on insider threat, digital forensics, or security investigations.
Proven experience in conducting and leading complex technical investigations, including the use of forensic tools (e.g., EnCase, FTK, X-Ways, or open-source alternatives).
Deep understanding of security technologies such as SIEM (e.g., Splunk, Elastic), EDR (e.g., CrowdStrike, SentinelOne), and UEBA like data sources.
Strong scripting and programming skills (e.g., Python, PowerShell) to automate tasks and analyze large datasets.
Excellent communication skills, both written and verbal, with the ability to explain complex technical concepts to non-technical audiences.
Experience working with legal and HR teams on sensitive employee-related matters.

Benefits

Comp & perks

Health insurance
Flexible work arrangements
Professional development opportunities