Insider Threat Analyst

The Global Resilience, Security and Transformation/Infosec Group is dedicated to the success of Lam through providing best-in-class and innovative information system solutions and services. Together, we support users globally with data, information, and systems to achieve their business objectives.

As an Insider Threat Analyst at Lam Research, you will play a critical role in helping manage insider threat investigations and helping to build out our insider threat capabilities. Your responsibilities will include analyzing and investigating anomalous user activities, indicators, and providing support to active incidents alongside our most valuable stakeholders. You may be asked to support cross-functional opportunities across Lam Research to help identify security trends and metrics, develop innovative use cases designed to detect anomalous events, and support education and awareness campaigns for insider risk and threat. You will use sophisticated technology and robust partnerships to enhance our insider risk posture against nation-state actors, negligent and malicious employee activity, and support high-risk populations from potential compromise. You will play a vital role in taking the Lam Research Insider Threat program to the next level by being both an analytical and technical expert on our team.

• Drive triage, investigation, and support management of insider threat cases.
• Identify, collect, and analyze technical and non-technical indicators from a variety of sources.
• Coordinate investigation and mitigation strategies with Insider Threat team’s management and colleagues, as well as additional internal stakeholders.
• Leverage your analytical and technical skills to identify patterns and trends and make recommendations to enhance detective and preventive controls.
• Perform log analysis and coordinate/perform event queries across enterprise systems.
• Operationalize and maintain the processes and playbooks required for insider threat analysis and support the development and execution of any new processes and playbooks.
• Leverage subject matter expertise to educate stakeholders on the importance of data and information sharing to protect and enable the business.
• Ensure investigative findings are documented, as needed.
• Support process improvement initiatives and provide project related support for the Insider Threat program.
• Respond to requests for ad-hoc support, reporting, and research topics from management and stakeholders, as required.
• Must be able to maintain confidentiality and always use sound discretion and judgment.

• Bachelor’s degree or Advanced Degree in Cybersecurity, Information Security, Counterintelligence, or related discipline.
• 3 years of experience in an Insider Threat role.
• Experience working Insider Threat investigations and/or providing analysis to an Insider Threat investigation.
• Experience with monitoring, analyzing, responding to DLP alerts and investigations.
• Basic knowledge of malicious insider threat indicators, such as those associated with theft of intellectual property, sabotage, and/or espionage.
• Demonstrated ability to collaborate with wider security, counterintelligence, and insider threat professional communities.
• Proficiency utilizing security-related tools.
• Working knowledge of investigation processes and techniques, leveraging technical and non-technical indicators and ability to prescribe best practices with our stakeholders.
• Excellent written and verbal communication skills with the ability to communicate professionally with team members, stakeholders, and senior leadership, as needed.
• Strong aptitude for identifying and learning new technologies.
• Ability to adapt to a fast-paced and evolving environment.
• A self-motivated person that can use their creative and experience-driven analytical skills to solve problems and do analysis.

• Formal education and training in insider threat and/or counterintelligence.
• Proficiency in identifying insider threats using a multitude of sources.
• Ability to breakdown and understand complex problems and the ability to develop a plan and innovative ways to address them.
• Strong people and team/relationship building skills in cross-functional global team settings.
• Knowledge and experience with Microsoft E5 security products.
• Direct experience with one or more DLP tools such as Netskope.

We believe it is important for every person to feel valued, included, and empowered to achieve their full potential. By bringing unique individuals and viewpoints together, we achieve extraordinary results.

Lam Research ("Lam" or the "Company") is an equal opportunity employer. Lam is committed to and reaffirms support of equal opportunity in employment and non-discrimination in employment policies, practices and procedures on the basis of race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, genetic information, marital status, sex (including pregnancy, childbirth and related medical conditions), gender, gender identity, gender expression, age, sexual orientation, or military and veteran status or any other category protected by applicable federal, state, or local laws. It is the Company's intention to comply with all applicable laws and regulations. Company policy prohibits unlawful discrimination against applicants or employees.

Lam offers a variety of work location models based on the needs of each role. Our hybrid roles combine the benefits of on-site collaboration with colleagues and the flexibility to work remotely and fall into two categories – On-site Flex and Virtual Flex. ‘On-site Flex’ you’ll work 3 days per week on-site at a Lam or customer/supplier location, with the opportunity to work remotely for the balance of the week. ‘Virtual Flex’ you’ll work 1-2 days per week on-site at a Lam or customer/supplier location, and remotely the rest of the time. This position will be in Fremont, CA or Tualatin, OR only.

IND123 #LI-FC1