Job Description:
At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. We do this by driving Responsible Growth and delivering for our clients, teammates, communities and shareholders every day.
Being a Great Place to Work is core to how we drive Responsible Growth. This includes our commitment to being an inclusive workplace, attracting and developing exceptional talent, supporting our teammates’ physical, emotional, and financial wellness, recognizing and rewarding performance, and how we make an impact in the communities we serve.
Bank of America is committed to an in-office culture with specific requirements for office-based attendance and which allows for an appropriate level of flexibility for our teammates and businesses based on role-specific considerations.
At Bank of America, you can build a successful career with opportunities to learn, grow, and make an impact. Join us!
Job Description:
At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. As part of Global Information Security (GIS), the Cyber Security Operations (CSO) function defends the organization and our clients by identifying, mitigating, and responding to cyber and insider threats. This role integrates responsibilities from both Insider Threat Investigations and Threat Management functions, emphasizing proactive risk detection, investigation, analysis, and partnership across the enterprise.
We value curiosity, critical thinking, operational excellence, and the ability to collaborate across diverse teams and technical backgrounds. You’ll have opportunities to learn, grow, and make an impact on global security.
Position Summary:
The Information Security Threat & Insider Risk Management Specialist is responsible for identifying, analyzing, and mitigating threats posed by malicious actors—both internal and external. This role conducts technical assessments, performs complex investigations, analyzes data from monitoring tools, and evaluates security controls to detect and address risks across the bank’s systems, applications, and personnel.
The specialist will develop subject‑matter expertise across insider threat indicators, cyber threat tactics, data loss trends, and adversarial behaviors. The role also requires strong communication skills, sound judgment, and the ability to collaborate with investigative teams, technical partners, and executive stakeholders.
A rotational on‑call duty, around once per month, may be required to support a global Follow‑the‑Sun (FTS) model.
Responsibilities:
Threat Detection, Investigation & Analysis
- Conduct complex insider threat and cyber‑related investigations using data from monitoring tools, system logs, and multiple internal resources
- Collect, analyze, and correlate data across applications, systems, and investigative platforms to identify anomalous or high‑risk activity
- Perform interviews and engage with persons of interest when required to validate investigative findings
- Assess systems, applications, and access mechanisms for compliance with GIS policies and threat frameworks
- Monitor emerging cyber and insider threat trends, tools, and adversarial tactics to ensure early detection and response
Security Controls, Risk Assessment & Remediation
- Evaluate the effectiveness of security controls, policies, and monitoring technologies; identify opportunities for improvement
- Document investigative findings, risk assessments, and recommended remediation through formal reports
- Utilize risk management and escalation processes to ensure timely mitigation of identified vulnerabilities or threats
- Support the implementation and improvement of preventative controls, insider risk tooling, data loss detection, and correlation engines
Collaboration & Stakeholder Engagement
- Partner with cross‑functional teams across GIS, Compliance, Legal, HR, and global business units to drive case resolution and strengthen controls
- Present investigative results, risk insights, and technical explanations to audiences with varying levels of cybersecurity understanding
- Serve as a subject matter expert on insider threat behaviors, detection mechanisms, and response procedures
- Develop strong operational partnerships and contribute to long‑term program enhancements
Documentation & Operational Excellence
- Maintain detailed investigative notes and case documentation
- Manage multiple cases, projects, and ad hoc requests with strong organizational discipline
- Adapt testing and investigative methodologies in alignment with evolving threat landscapes and regulatory requirements
Required Skills & Qualifications:
- 5+ years of experience in insider threat, cyber threat analysis, counterintelligence, or related investigative functions
- Strong knowledge of networking fundamentals, log analysis, security monitoring, and adversarial techniques
- Experience with investigative and monitoring tools (e.g., Splunk, ENCASE, CrowdStrike, SIEM platforms)
- Demonstrated ability to conduct complex investigations independently with minimal oversight
- Exceptional written and verbal communication skills, including presenting to executives
- Strong analytical, problem‑solving, and critical‑thinking skills
- Proficiency in Jira, Excel, and executive‑level reporting
- Ability to manage multiple concurrent investigations with minimal risk impact
- Ability to collaborate across regions, cultures, and technical skill levels
Desired Skills & Qualifications:
- Experience with national security threats, intelligence community operations, or handling classified/sensitive information
- Familiarity with human behavior, psychology, or behavioral analysis as related to insider threats
- Advanced experience with Splunk, ENCASE, CrowdStrike, or similar investigative technologies
- Technical experience with DLP, IDS/IPS, SIEMs, cloud environments, or network/system administration
- Experience with scripting or database query languages
- Incident response experience
- OSINT research and investigative sleuthing skills
- Relevant cybersecurity/investigative certifications (Security+, CEH, CISSP, CCNA/CCNP, EnCE, etc.)
- Bachelor’s degree in Computer Science, Information Security, Intelligence Studies, or related field
