Senior Security Engineer, Insider Trust

About ChainlinkChainlink is the industry-standard oracle platform bringing the capital markets onchain and powering the majority of decentralized finance (DeFi). The Chainlink stack provides the essential data, interoperability, compliance, and privacy standards needed to power advanced blockchain use cases for institutional tokenized assets, lending, payments, stablecoins, and more. Since inventing decentralized oracle networks, Chainlink has enabled tens of trillions in transaction value and now secures the vast majority of DeFi.Many of the world s largest financial services institutions have also adopted Chainlink s standards and infrastructure, including Swift, Euroclear, Mastercard, Fidelity International, UBS, S&P Dow Jones Indices, FTSE Russell, WisdomTree, ANZ, and top protocols such as Aave, Lido, GMX and many others. Chainlink leverages a novel fee model where offchain and onchain revenue from enterprise adoption is converted to LINK tokens and stored in a strategic Chainlink Reserve. Learn more at chain.link.About The RoleThe Security Department is the guardian of Chainlink Labs people, infrastructure, and data. Its principal objective is to safeguard Chainlink Labs and its assets against threats from external and internal sources. It accomplishes this mission through a combination of specialized security engineering, the deployment of cutting-edge technologies, and forward-thinking policy development. The Security Department also fosters a culture of security awareness throughout the entire company in order to safeguard our most valuable assets—our team members. To this end, the Insider Trust Team (ITT) Senior Security Engineer is responsible for leading the effort in identifying, investigating, and mitigating security policy violations and deviations from CLL s security best practices that cause, or have the potential to cause, harm to personnel, systems, facilities, plans, intentions, capabilities, and/or brand reputation. To prevent such incidents in the first place, he or she not only conducts technical investigations, but will also help architect detection strategies with a focus on automation and build out scalable infrastructure to manage it. (Note: The industry standard term is “Insider Threat.” We use the term “Insider Trust” here at CLL.Your ImpactOwn and lead building out the Insider Trust Team s infrastructure to engineer and automate end-to-end detection and investigation workflows.Develop, measure, and tune detection rules in Sigma to ensure effective and sustainable operations.Drive projects with a focus on Insider Risks, ranging from access abuse and intellectual property theft, to novel risks emerging within the blockchain/Web3 space.Work closely with cross-functional teams, including Threat Management, People, Legal, IT, and Engineering, and provide technical expertise and evidence to lead insider investigations.Assist in conducting sensitive interviews during insider threat investigations, bringing your technical subject matter expertise to support fact finding.Proactively identify and implement areas of improvement and modernization.Requirements7+ years of experience conducting technical investigations and working in an Insider Threat capacity. We are seeking senior candidates.Deep experience in macOS focused environments, including log collection, log analysis, digital investigations, and forensics.Knowledge of Insider Threat tactics and attack paths, data exfiltration techniques, and experience running and leading insider incidents independently and as part of a team.Broad familiarity with Insider Threat investigations of modern cloud infrastructure.Strong critical thinking skills, as well as integrity, objectivity, and maturity.Preferred RequirementsPrior success in remote-first environments as a self-starter Insider Threat security engineer.Previous scripting experience (Python, Bash, or similar) to include scripting for data parsing/enrichment and automations.Experience with detection‑a