Engineer II - Insider Threat

• Administer and continuously tune DLP policies/rules to reduce risky data movement while minimizing false positives and business disruption.
• Investigate and respond to DLP alerts validate severity identify the data and pathway involved and drive incident handling to resolution.
• Partner with stakeholders to refine data classification detection logic and control coverage across common exfil paths (email web uploads endpoints/USB cloud sharing collaboration platforms).
• Build and improve DLP-related playbooks workflows and response standards (triage steps evidence collection escalation paths and post-incident improvements).

• Monitor user activity signals (identity endpoint email collaboration tools cloud activity etc.) to identify suspicious behavior and potential insider risk.
• Lead low to moderate-complexity investigations involving data misuse/exfiltration policy violations fraud indicators or compromised accounts and escalate higher-risk cases with strong evidence and timelines.
• Produce high-quality documentation: investigation notes evidence packages root cause summaries and stakeholder-ready reports.
• What Success Looks Like (First 6-12 Months)
• DLP policies are measurably better tuned (lower false positives higher signal quality) with documented rationale and change control.
• Investigations are timely well-documented and defensible with clear outcomes and stakeholder communication.
• New or improved insider threat use cases/playbooks are implemented based on investigation learnings and emerging risk patterns.

• Bachelor's degree in Cybersecurity Computer Science Information Systems Behavioral Science or equivalent practical experience.
• 3-5 years of progressive experience in cybersecurity investigations or risk management including 1+ year hands-on in DLP operations and/or insider threat monitoring.
• Practical experience administering or operating DLP controls: policy creation tuning alert triage incident response support and reporting.
• Strong written and verbal communication skills including the ability to brief stakeholders and document investigations clearly.
• Demonstrated discretion handling sensitive/confidential investigations.

• Insider threat concepts: behavioral indicators user activity monitoring investigative methods and evidence handling.
• Privacy/compliance/employment standards relevant to investigations (e.g. GDPR HIPAA SOX CCPA) and the need-to-know principle.

• GIAC GCIH
• CompTIA Security+ or CySA+
• CEH
• SSCP

What We Do

Cencora is a leading pharmaceutical solutions organization centered on improving the lives of people and animals everywhere. With 46000+ global team members we have the opportunity to make a positive impact on healthcare in communities everywhere. Our team members are empowered to activate their careers through a collective of tools and resources designed to support individual career interests and aspirations. We value our listening culture that actions real outcomes and our team members appreciate and recognize one another for contributions that are making a meaningful global impact. No matter what your role is here the work we do together has meaning. When you join our team you become a crucial part of a greater purpose. We’re committed to supporting you personally and professionally so we can achieve more together at the center of health.Protect yourself from job scams: Recruitment scams are on the rise. To protect yourself we urge you to be vigilant and follow these guidelines > https://careers.cencora.com/us/en/job-scams

Gallery