Insider Risk Management Policy & Use Case Review Specialist/Analyst, AVP

Position Overview

Job Title: Insider Risk Management Policy & Use Case Review Specialist/Analyst

Location: Pune, India

Corporate Title: Assistant Vice President

Role Description:

The Insider Risk Management Policy & Use Case Review Specialist will play a critical role in enhancing the effectiveness and efficiency of our insider threat detection program. This individual will be responsible for meticulously reviewing existing insider risk policies and use cases, analysing their performance, and recommending data-driven adjustments to reduce false positives while maintaining or improving detection efficacy. This role requires a strong understanding of security principles, data analysis, and the ability to translate complex technical findings into actionable policy and configuration recommendations.

What we'll offer you

As part of our flexible scheme, here are just some of the benefits that you'll enjoy

• Best in class leave policy
• Gender neutral parental leaves
• 100% reimbursement under childcare assistance benefit (gender neutral)
• Sponsorship for Industry relevant certifications and education
• Employee Assistance Program for you and your family members
• Comprehensive Hospitalization Insurance for you and your dependents
• Accident and Term life Insurance
• Complementary Health screening for 35 yrs. and above

Your key responsibilities

Policy Review & Optimization

• Conduct systematic reviews of existing insider risk management policies, standards, and procedures to ensure alignment with organizational objectives, regulatory requirements, and best practices.
• Identify ambiguous, redundant, or outdated policy language that may contribute to misinterpretations or false alerts.
• Propose clear, concise, and actionable revisions to policies that enhance clarity and reduce the likelihood of false positives.

Use Case Performance Analysis

• Analyze data from our Insider Risk Management (IRM) platforms (e.g., UEBA, DLP, SIEM) to assess the performance of current detection use cases.
• Create, tune, and optimize SIEM rules (GCP), alerts, and correlation policies to detect advanced threats, anomalies, and security incidents.
• Evaluate alert volumes, true positive rates, false positive rates, and investigation outcomes for specific use cases.
• Collaborate with security analysts and investigators to understand the root causes of false positives and identify patterns.

False Positive Reduction & Tuning

• Develop and implement strategies for fine-tuning use cases, rules, and alert thresholds to minimize false positives without compromising the ability to detect genuine threats.
• Propose adjustments to data sources, correlation logic, and anomaly detection algorithms based on performance analysis.
• Document all changes to use cases and their rationale, including expected impact on alert volumes and detection rates.

Cross-Functional Collaboration

• Work closely with Insider Threat Analysts, Security Engineers, Data Scientists, Legal, HR, and other stakeholders to gather feedback, validate findings, and implement approved policy and use case changes.
• Participate in incident review meetings to understand how policies and use cases perform in real-world scenarios.

Documentation & Reporting

• Maintain comprehensive documentation of all policies, use cases, tuning parameters, and review cycles.
• Prepare regular reports on use case performance, false positive reduction metrics, and policy effectiveness for management and stakeholders.

Research & Best Practices

• Stay current with industry trends, emerging insider threat techniques, and advancements in IRM technology and best practices for policy and use case optimization.

Your skills and experience

Qualifications

• Education:Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Data Analytics, or a related field. Relevant certifications (e.g., CISSP, CISM, GCIH, CCSP) are a strong plus.

Experience:

• 5+ years of experience in cybersecurity, with at least 1-2 years specifically focused on insider threat, GCP Chronicle, security operations, security analysis, or policy development.
• Proven experience specifically with SIEM platforms, including significant hands-on experience withGCP Cloud and Chronicle SIEM (highly preferred)
• Proven experience in data analysis, report generation, and metric tracking related to security events or alerts.
• Familiarity with security frameworks (NIST, ISO 27001) and regulatory compliance (GDPR, CCPA, HIPAA, etc.).

Technical Skills

• Experience with Insider Risk Management (IRM) platforms, User and Entity Behaviour Analytics (UEBA) tools, Data Loss Prevention (DLP) systems, and Security Information and Event Management (SIEM) solutions.
• GCP Security: Cloud Security Command Center (CSCC), Security Health Analytics, Cloud Logging, Cloud Monitoring, Pub/Sub, Cloud Armor, VPC Service Controls, IAM, Secret Manager.
• Strong analytical skills with the ability to interpret complex data sets and identify trends and anomalies.
• Proficiency in scripting languages (e.g., Python) or query languages (e.g., SQL or SPL or KQL) for data manipulation and analysis is a plus.
• Understanding of common attack vectors, threat actor methodologies, and data exfiltration techniques.

Soft Skills

• Excellent written and verbal communication skills, with the ability to articulate complex technical information to non-technical audiences.
• Strong attention to detail and a methodical approach to problem-solving.
• Ability to work independently and collaboratively in a fast-paced environment.
• High degree of integrity and discretion when handling sensitive information

How we'll support you

• Training and development to help you excel in your career
• Coaching and support from experts in your team
• A culture of continuous learning to aid progression
• A range of flexible benefits that you can tailor to suit your needs

About us and our teams

Please visit our company website for further information:

We strive for a in which we are empowered to excel together every day. This includes acting responsibly, thinking commercially, taking initiative and working collaboratively.
Together we share and celebrate the successes of our people. Together we are Deutsche Bank Group.
We welcome applications from all people and promote a positive, fair and inclusive work environment.