The Security Department is the guardian of Chainlink Labs’ people, infrastructure, and data. Its principal objective is to safeguard Chainlink Labs and its assets against threats from external and internal sources. It accomplishes this mission through a combination of specialized security engineering, the deployment of cutting-edge technologies, and forward-thinking policy development. The Security Department also fosters a culture of security awareness throughout the entire company in order to safeguard our most valuable assets—our team members. To this end, the Insider Trust Team (ITT) Senior Security Engineer is responsible for leading the effort in identifying, investigating, and mitigating security policy violations and deviations from CLL’s security best practices that cause, or have the potential to cause, harm to personnel, systems, facilities, plans, intentions, capabilities, and/or brand reputation. To prevent such incidents in the first place, he or she not only conducts technical investigations, but will also help architect detection strategies with a focus on automation and build out scalable infrastructure to manage it. (Note: The industry standard term is “Insider Threat.” We use the term “Insider Trust” here at CLL.

Own and lead building out the Insider Trust Team’s infrastructure to engineer and automate end-to-end detection and investigation workflows.

Develop, measure, and tune detection rules in Sigma to ensure effective and sustainable operations.

Drive projects with a focus on Insider Risks, ranging from access abuse and intellectual property theft, to novel risks emerging within the blockchain/Web3 space.

Work closely with cross-functional teams, including Threat Management, People, Legal, IT, and Engineering, and provide technical expertise and evidence to lead insider investigations.

Assist in conducting sensitive interviews during insider threat investigations, bringing your technical subject matter expertise to support fact finding.

Proactively identify and implement areas of improvement and modernization.

7+ years of experience conducting technical investigations and working in an Insider Threat capacity. We are seeking senior candidates.

Deep experience in macOS focused environments, including log collection, log analysis, digital investigations, and forensics.

Knowledge of Insider Threat tactics and attack paths, data exfiltration techniques, and experience running and leading insider incidents independently and as part of a team.

Broad familiarity with Insider Threat investigations of modern cloud infrastructure.

Strong critical thinking skills, as well as integrity, objectivity, and maturity.

Prior success in remote-first environments as a self-starter Insider Threat security engineer.

Previous scripting experience (Python, Bash, or similar) to include scripting for data parsing/enrichment and automations.

Collaborative, straightforward communication skills with the ability to write clear incident updates and summaries. Ability to explain risk, impact, and trade‑offs to both technical and non‑technical stakeholders and have a proven record of building trust with partner teams during high‑pressure situations.

Domain experience with blockchain/Web3 threats.

Usage of AI technology to augment and enhance Insider Threat investigations

Open-source contributions to security related projects, with a focus on Insider Threat.

The Security Department is the guardian of Chainlink Labs’ people, infrastructure, and data. Its principal objective is to safeguard Chainlink Labs and its assets against threats from external and internal sources. It accomplishes this mission through a combination of specialized security engineering, the deployment of cutting-edge technologies, and forward-thinking policy development. The Security Department also fosters a culture of security awareness throughout the entire company in order to safeguard our most valuable assets—our team members. To this end, the Insider Trust Team (ITT) Senior Security Engineer is responsible for leading the effort in identifying, investigating, and mitigating security policy violations and deviations from CLL’s security best practices that cause, or have the potential to cause, harm to personnel, systems, facilities, plans, intentions, capabilities, and/or brand reputation. To prevent such incidents in the first place, he or she not only conducts technical investigations, but will also help architect detection strategies with a focus on automation and build out scalable infrastructure to manage it. (Note: The industry standard term is “Insider Threat.” We use the term “Insider Trust” here at CLL.

Own and lead building out the Insider Trust Team’s infrastructure to engineer and automate end-to-end detection and investigation workflows.

Develop, measure, and tune detection rules in Sigma to ensure effective and sustainable operations.

Drive projects with a focus on Insider Risks, ranging from access abuse and intellectual property theft, to novel risks emerging within the blockchain/Web3 space.

Work closely with cross-functional teams, including Threat Management, People, Legal, IT, and Engineering, and provide technical expertise and evidence to lead insider investigations.

Assist in conducting sensitive interviews during insider threat investigations, bringing your technical subject matter expertise to support fact finding.

Proactively identify and implement areas of improvement and modernization.

7+ years of experience conducting technical investigations and working in an Insider Threat capacity. We are seeking senior candidates.

Deep experience in macOS focused environments, including log collection, log analysis, digital investigations, and forensics.

Knowledge of Insider Threat tactics and attack paths, data exfiltration techniques, and experience running and leading insider incidents independently and as part of a team.

Broad familiarity with Insider Threat investigations of modern cloud infrastructure.

Strong critical thinking skills, as well as integrity, objectivity, and maturity.

Prior success in remote-first environments as a self-starter Insider Threat security engineer.

Previous scripting experience (Python, Bash, or similar) to include scripting for data parsing/enrichment and automations.

Collaborative, straightforward communication skills with the ability to write clear incident updates and summaries. Ability to explain risk, impact, and trade‑offs to both technical and non‑technical stakeholders and have a proven record of building trust with partner teams during high‑pressure situations.

Domain experience with blockchain/Web3 threats.

Usage of AI technology to augment and enhance Insider Threat investigations

Open-source contributions to security related projects, with a focus on Insider Threat.