Cybersecurity Engineer - Insider Risk and Forensic Analysis

The Cybersecurity Engineer focused on Insider Risk and Forensic Analysis joins Zions Bancorporation’s Enterprise Information Security team to tackle insider risk, data loss prevention, and digital forensics. This role emphasizes building monitoring use cases, guiding incident response, and handling sensitive insider incidents within the organization’s security program.

Responsibilities

• Serve as a subject matter expert in enterprise cybersecurity tools and processes, including SIEM, EDR, and forensics platforms.
• Develop and implement monitoring use cases, cyber insider risk procedures, playbooks, and related technical documentation.
• Collaborate with Enterprise Cybersecurity Architecture and technology teams on monitoring and alerting infrastructure, processes, and tools.
• Train, mentor, and guide other team members on cyber incident response practices and tooling.
• Respond to insider risk incidents, serving as an escalation point for high-priority or highly complex cases.
• Handle sensitive employee information and internal investigations.
• Perform digital forensic collections and investigations for the organization.
• Monitor and provide tuning feedback for the cybersecurity toolset.
• Other duties as assigned.

Requirements

• 2 plus years of progressive technical experience in one or more technical cybersecurity domains with a preferred focus on digital forensics or equivalent education.
• Experience with digital forensic evidence collection and investigations.
• Experience with insider risk investigations.
• Experience with resolving DLP incidents.
• Hands-on technical experience with one or more industry-standard digital forensic products.
• Hands-on technical experience with one or more commercial SIEM products, including defining and writing alert conditions/use cases and daily incident investigations.
• Working knowledge of common attack vectors, various classes of attacks (passive, active, insider, close-in, distributed, etc.) and general attack stages (footprinting and scanning, enumeration, gaining access, escalation or privileges, maintaining access, network exploitation, covering tracks, etc.).
• Effective interpersonal and written communication skills, including the ability to produce technical documentation.
• Requires a Bachelor’s in Information Technology, Computer Science, Business or a related technical field. A combination of education and experience may meet qualifications.

Technologies

• SIEM
• EDR
• digital forensics platforms
• Python
• JavaScript
• PowerShell
• Bash

Benefits

• Medical, Dental and Vision Insurance - START DAY ONE
• Life and Disability Insurance, Paid Parental Leave and Adoption Assistance
• Health Savings (HSA), Flexible Spending (FSA), and dependent care accounts
• Paid Training, Paid Time Off (PTO) and 11 Paid Federal Holidays
• 401(k) plan with company match, Profit Sharing
• Mental health benefits including coaching and therapy sessions
• Tuition Reimbursement
• Employee Ambassador preferred banking products

Location

• Hybrid work from home schedule with a minimum of three days per week in the office at the new Zions Technology Center in Midvale, UT
• The Zions Technology Center is a 400,000-square-foot technology campus in Midvale, Utah.
• Located on the former Sharon Steel Mill superfund site, the sustainably built campus is the company’s primary technology and operations center.
• Electric vehicle charging stations and proximity to Gardner Village UTA TRAX station; at least 75% of building power is from on-site solar energy; access to outdoor recreation, parks, trails, shareable bikes and locker rooms; large modern cafe; healthy indoor environment with natural light; LEED-certified with low VOC materials.

Plus

• Experience with Financial Institution processes, regulations, and technologies is highly preferred.
• Technical familiarity with networking concepts, architectures, and tools, including network traffic analysis, proxies, switches, load balancers, routers, and firewalls.
• Knowledge of system administration concepts for Windows and UNIX/Linux operating systems.
• Development experience with scripting languages such as Python, JavaScript, PowerShell, Bash, etc., is a plus.
• Experience with threat hunting methods and approaches is a plus.
• Technical certifications such as GCFE, GCFA, CCCE, CFCE, or 13Cubed certifications are a plus.