Insider Risk Engineer

Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.Dragonfli Group is seeking a Senior Security Engineer with deep Splunk content engineering expertise and a proven track record in insider risk detection. This is a detection-engineering-forward role requiring hands-on SPL development, alert fidelity improvement, and operational investigation support across a complex enterprise toolset including Splunk Enterprise Security, UEBA, CrowdStrike Falcon, Microsoft Purview/Defender/Entra, DLP, and Databricks.This is a multi-year contract position supporting a large U.S. federal agency. Candidates with prior federal contracting experience are preferred. U.S. Citizenship required. All work must be performed within the continental United States.Primary Responsibilities:Detection Engineering and Content DevelopmentDesign, build, and maintain insider risk detection use cases and monitoring workflows with a primary focus on Splunk Enterprise Security, UEBA, and SPL content engineeringWrite, optimize, and operationalize Splunk searches, correlation rules, dashboards, and alerts to improve fidelity and reduce false positivesDevelop and refine detection use cases targeting anomalous user behavior, data exfiltration, policy violations, and suspicious endpoint activityInvestigate alert and case trends to identify opportunities for rule tuning, use case expansion, and operational maturity improvementIncident Response and InvestigationSupport incident triage, investigation, and response related to insider risk, suspicious user behavior, and potential data misusePerform CrowdStrike Falcon alert review, tuning, and incident response support including false positive identification and credible threat escalationLead and assist in investigations involving potential insider threats, intellectual property matters, fraud, and high-stakes security incidentsProgram and Tool MaturationDevelop and maintain playbooks and response workflows for insider risk scenariosAdminister and optimize the insider risk toolset: Splunk ES, UEBA, CrowdStrike, Microsoft Purview/Defender/Entra, DLP, and adjacent technologiesAnalyze current tool utilization and recommend enhancements to improve detection visibility, investigation efficiency, and operational coverageSupport continuous improvement across Splunk, CrowdStrike, Microsoft, DLP, Databricks, and SOAR platformsImplement federal government and industry standards related to insider threat programs and maintain programmatic gap analysesStakeholder CoordinationPartner with security operations, insider risk, cyber defense, and business stakeholders to improve detection coverage and response postureCoordinate with technology and business leaders to develop programmatic solutions and deliver executive-level presentations on findings and program status