Lead Corporate Security Operations Analyst (Insider Threat Program Lead)

Job description

Our Purpose Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential. Title and Summary Lead Corporate Security Operations Analyst (Insider Threat Program Lead) Who is Mastercard? Mastercard is a global technology company in the payments industry. Our mission is to connect and power an inclusive, digital economy that benefits everyone, everywhere by making transactions safe, simple, smart, and accessible. Using secure data and networks, partnerships, and passion, our innovations and solutions help individuals, financial institutions, governments, and businesses realize their greatest potential. Our decency quotient, or DQ, drives our culture and everything we do inside and outside of our company. With connections across more than 210 countries and territories, we are building a sustainable world that unlocks priceless possibilities for all. Mission First, People Always As Corporate Security, we are responsible for keeping Mastercard safe and secure from cyber and physical threats, and it is our people on the front who make this happen every day. By taking care of our people, their well-being, and their career development, we provide them with the necessary tools and environment to ensure the success of our mission. Overview The Security Event Management group is seeking a highly motivated and experienced security professional to lead the direction and continued maturity of Mastercard's Insider Threat capability. As the Lead Insider Threat specialist, you will serve as the functional authority for Insider Threat across Security Operations, setting direction, defining standards, and driving the evolution of people, process, and technology capabilities that enable the organization to identify, detect, and respond to insider risk. This role provides leadership through expertise, influence, and decision-making, working across a global network of security and business stakeholders. The role is responsible for establishing and maintaining the Insider Threat operating model and guiding the implementation of improvements across Data Loss Prevention (DLP), User Activity Monitoring (UAM), User Behavior Analytics (UBA), investigations, detection content, monitoring procedures, case management processes, and supporting technologies. Working closely with Security Operations SMEs and operational teams, you will identify capability gaps, define enhancements, develop roadmap priorities, and ensure the Insider Threat function continues to mature in response to evolving business requirements and threat landscapes. You will act as the primary advisor on Insider Threat strategy, policies, standards, and procedures, balancing security objectives with business, privacy, legal, regulatory, and human resources requirements. Through collaboration and influence, you will drive consistency, operational excellence, and the adoption of best practices across the organization. This role requires a forward-looking mindset, continually assessing emerging Insider Threat tactics, techniques, and procedures (TTPs), industry trends, and technological advancements to develop and implement improvements that strengthen Mastercard's overall Insider Threat capability and long-term resilience. As operational needs arise, this role may directly lead investigations or incident response activities. In this role you will: • Set Insider Threat investigation standards and guide SMEs on complex, high-risk cases. • Analyze program trends, risks, and metrics to identify improvements and support leadership decisions. • Build Insider Threat detection strategies, controls, and countermeasures aligned to emerging TTPs. • Drive the direction and maturity of DLP, UAM, and UBA capabilities with technology owners. • Maintain Insider Threat policies, processes, procedures, and operating standards. • Serve as the lead Insider Threat liaison for Technology, Security, HR, Legal, Privacy, Compliance, and M&A partners. • Assess capabilities and risks, identify control gaps, define remediation plans, and drive the resolution of issues. • Define capability roadmaps and partner with engineering teams to deliver tool and platform enhancements. • Track industry trends, emerging threats, and best practices to advance program maturity. • Maintain current, accurate, and published program documentation and inventories. • Design exercises to test and strengthen Insider Threat capabilities. • Lead the Insider Threat Working Group and escalate priorities to the Insider Threat Steering Committee. All About You The ideal candidate for this position should have: • A demonstrated ability to conduct, oversee, or support sensitive, confidential investigations involving employee activity while maintaining the highest standards of professionalism, discretion, objectivity, evidentiary integrity, and privacy compliance, also balancing security, privacy, legal, and human resources considerations. • Extensive experience in security operations, incident response, insider risk, digital forensics, or related cybersecurity disciplines. • A strong understanding of investigative methodologies, evidentiary handling, chain of custody, and detailed report writing, with the ability to influence stakeholders and explain complex technical matters to diverse audiences. • The ability to consistently apply an understanding of privacy, data protection, and regulatory considerations, including GDPR and related legislation, to operational requirements. • Experience developing, enhancing, or governing Insider Threat, Data Loss Prevention, User Activity Monitoring, User Behavior Analytics, or related security capabilities. • Experience with Microsoft security technologies, including Microsoft Purview, Microsoft Defender / IRM, Microsoft Sentinel, and Endpoint DLP. • Experience with Security Information and Event Management (SIEM) platforms and security event analysis. • Working knowledge of Windows and macOS operating systems, including key architectural and investigative differences. • Familiarity with threat hunting methodologies, open-source intelligence (OSINT), and cyber investigation techniques. • Relevant industry certifications such as CISSP, GCIH, GCIA, Security+, or equivalent; desirable. Corporate Security Responsibility Every person working for, or on behalf of, Mastercard is responsible for information security. All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and therefore, it is expected that the successful candidate for this position must: • Abide by Mastercard’s security policies and practices; • Ensure the confidentiality and integrity of the information being accessed; • Report any suspected information security violation or breach, and • Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines. Mastercard is a merit-based, inclusive, equal opportunity employer that considers applicants without regard to gender, gender identity, sexual orientation, race, ethnicity, disabled or veteran status, or any other characteristic protected by law. We hire the most qualified candidate for the role. In the US or Canada, if you require accommodations or assistance to complete the online application process or during the recruitment process, please contact reasonable_accommodation@mastercard.com and identify the type of accommodation or assistance you are requesting. Do not include any medical or health information in this email. The Reasonable Accommodations team will respond to your email