Head of Insider Risk - USDS

About the Team

The USDS JV Insider Risk team is responsible for protecting TikTok’s people, data, and systems from threats that originate within the organization. We partner across Security, Legal, HR, IT, and Engineering to detect, investigate, and mitigate insider risks ranging from data exfiltration and policy violations to fraud and unauthorized access.

About the Role

We are seeking a Insider Risk Program Lead to own the strategy, maturity, and day-to-day operations of our insider risk program. This is a leadership role: you will define program vision, build and mentor a team of investigators and analysts, establish policy and process frameworks, and serve as the senior point of contact for insider risk across the organization. The ideal candidate combines deep technical expertise in digital forensics and incident response (DFIR) with proven program-building experience and strong cross-functional leadership skills.

Responsibilities

• Own the end-to-end insider risk program — strategy, roadmap, policies, playbooks, and success metrics — and drive continuous maturity improvements aligned with industry frameworks (NIST, CISA, Carnegie Mellon CERT).
• Build, lead, and mentor a high-performing team of insider risk investigators and analysts; establish clear roles, career development paths, and performance standards.
• Design and operationalize detection and monitoring capabilities using SIEM, EDR, DLP, UEBA, and cloud-native logging (AWS CloudTrail, Azure Monitor, GCP Audit Logs) to identify behavioral indicators of insider threats.
• Oversee complex investigations involving data exfiltration, intellectual property theft, unauthorized access, fraud, and policy violations; ensure forensic rigor, defensible evidence handling, and chain-of-custody integrity.
• Develop and refine risk-scoring models and behavioral analytics that prioritize high-risk activity — including exfiltration via email, cloud storage, USB, and lateral movement within internal networks.
• Partner with Security & Privacy, Legal, HR/ER, IT, and Engineering leadership to coordinate investigations, remediation actions, and policy enforcement; serve as the primary insider risk advisor to senior stakeholders.
• Deliver executive-level reporting on program health, investigation outcomes, risk trends, and key performance indicators; translate technical findings into business-relevant narratives for leadership and audit audiences.
• Define tooling strategy and manage the insider risk technology stack — evaluate, select, and optimize platforms for forensics, monitoring, case management, and analytics.
• Establish and maintain insider risk awareness and training initiatives to promote a security-conscious culture; develop tabletop exercises and simulations to validate program readiness.
• Stay ahead of the evolving threat landscape by tracking emerging insider risk TTPs, regulatory requirements, and best practices in forensic analysis, incident response, and privacy-preserving monitoring.

Minimum Qualifications

• Bachelor’s degree in Cybersecurity, Digital Forensics, Information Technology, Computer Science, or equivalent professional experience in related fields as well as minimum 5 years of progressive experience in insider risk, digital forensics, incident response, or cybersecurity investigations, with at least 2 years in a team lead, manager, or program-owner capacity.
• Demonstrated experience standing up or materially maturing an insider risk or insider threat program, including policy development, detection engineering, and cross-functional governance.
• Expertise in digital forensic tools (e.g., EnCase, FTK, Cellebrite, X-Ways, AXIOM) and scripting languages (Python, Bash, PowerShell) for automation and analysis.
• Advanced knowledge of Windows, macOS, and Linux at a forensic level — file systems (NTFS, APFS, HFS+, ext4), memory analysis, artifact extraction, and log parsing.
• Hands-on experience with EDR solutions (e.g., CrowdStrike Falcon, Carbon Black), SIEM platforms (e.g., Splunk, QRadar, Sentinel), DLP, and UEBA technologies.
• Familiarity with cloud service providers (AWS, Azure, GCP) and their logging, auditing, and investigation capabilities.
• Strong communication skills with demonstrated ability to brief senior leadership and external stakeholders on sensitive investigations and program status.

Preferred Qualifications

• Master’s degree in Cybersecurity, Information Assurance, or a related discipline and/or Industry certifications: GCFE, GCFA, GCIH, EnCE, CCE, CISSP, CISM, or OSCP.
• SANS training (FOR508, FOR498, MGT512) or equivalent program management and advanced forensics coursework.
• Experience operating insider risk programs in highly regulated environments (financial services, government, critical infrastructure) or at companies with 10,000+ employees.
• Knowledge of MITRE ATT&CK (particularly the Insider Threat matrix), NIST SP 800-53, and CISA insider threat best practices.
• Experience with data analytics or machine learning approaches to behavioral anomaly detection.