Insider Threat Monitoring Analyst - Mid-Level [U.S. Citizenship & CBP BI - High Trust Required]

About the role

Join Via Logic supporting U.S. Customs and Border Protection cybersecurity operations. As a Mid-Level Insider Threat Monitoring Analyst, you'll support insider threat monitoring activities by analyzing user behavior, access patterns, and security events to identify potential insider threat indicators.

Responsibilities

• Monitor Data Loss Prevention (DLP) solutions and other applicable security tools to support insider threat and security operations investigations.
• Investigate DLP alerts involving potential data exfiltration of CBP mission data or sensitive employee information.
• Support User Activity Monitoring (UAM) activities and investigative tasks as directed by government staff.
• Monitor network activity for potential misuse and security policy violations.
• Analyze alerts and investigative information to identify suspicious or anomalous activity and support appropriate investigative action.
• Support investigations involving potential malicious activity, alleged criminal activity, or unauthorized disclosure of information.
• Support sensitive-data spillage response by helping assess incidents and recommending appropriate handling and sanitization methods in accordance with applicable guidance and procedures.
• Monitor government laptops and mobile devices associated with foreign travel for suspicious activity and policy violations.
• Recommend improvements to insider threat alert triggers and detections across security tools and logging sources.
• Document investigative activity and contribute to incident notifications, case analysis, reports, and other required work products.

Requirements

• U.S. citizenship.
• Ability to obtain and maintain the required CBP background investigation and suitability determination for access to government facilities and systems.
• Available to work onsite, primarily in Ashburn, VA (specific worksite expectations confirmed for assignment).
• 3+ years of relevant professional experience in cybersecurity operations, insider threat monitoring, security investigations, incident detection and response, cyber forensics, or a related area.

Qualifications

• Experience analyzing user activity, security events, alerts, logs, or similar technical data to identify suspicious or anomalous behavior.
• Experience investigating or supporting investigations involving security incidents, policy violations, data loss, or potentially unauthorized activity.
• Knowledge of Data Loss Prevention (DLP), User Activity Monitoring (UAM), or similar security monitoring concepts and capabilities.
• Ability to analyze information from multiple sources, identify relevant patterns or concerns, and document investigative findings clearly.
• Ability to communicate technical findings and collaborate effectively with security analysts, investigators, government personnel, and other stakeholders.

Skills

• Experience working within or closely alongside a Security Operations Center or insider threat program (preferred).
• Hands‑on experience with DLP or UAM tools and workflows (preferred).
• Experience supporting cyber forensic or security investigations (preferred).
• Experience investigating potential data exfiltration, sensitive‑data spillages, or misuse of enterprise systems (preferred).
• Experience developing or refining security alerting or detection logic based on investigative findings (preferred).

Benefits

• Healthcare coverage and paid time off.
• Collaborative teammates who share knowledge and help each other grow.
• Opportunities to deepen your specialty and explore adjacent areas of cybersecurity.
• Meaningful work protecting systems and information that support a federal mission.

Pay

$106,000–$126,000 annually, depending on experience and qualifications.

Schedule

Full‑time onsite in Ashburn, VA; core task coverage generally weekdays, 8:30 a.m.–5:00 p.m. Eastern Time, with on‑call support requirements based on assignment needs.