At The Whiteam Consulting, we are looking for an experienced Insider Threat & DLP Security Analyst to join our cybersecurity projects focused on protecting sensitive enterprise data from deliberate or accidental external loss.

The selected candidate will contribute to the extension and improvement of DLP baseline controls, identifying potential insider threat scenarios, analysing security data and logs, detecting visibility and control gaps, and developing threat hunting techniques to improve the protection of Santander data.

The role requires strong experience in data analysis, security monitoring, SIEM and log analysis, together with hands-on experience with Microsoft Purview DLP and a solid understanding of Cloud, SaaS, and CASB environments.

This position is open exclusively to candidates based in Spain, Poland, the UK, or Portugal.

Responsibilities

• Assess and balance insider risks against business requirements for securely sharing data with approved third parties, regulators, and customers.

• Support the protection of sensitive enterprise data while ensuring that security controls allow colleagues to perform their activities effectively.

• Identify and define insider threat use cases in collaboration with the DLP Insider Threat Lead.

• Perform insider threat hunting activities across security monitoring and data sources.

• Analyse security events, logs, and data patterns to identify potentially suspicious activity and insider threat indicators.

• Identify visibility, monitoring, and security control gaps across different systems and platforms.

• Work with relevant technical and security teams to address identified gaps and improve security controls.

• Develop and recommend high-fidelity threat hunting techniques to the DLP Insider Threat Lead.

• Contribute to the definition of regular threat hunting activities and automated alerting use cases.

• Investigate and analyse complex security scenarios involving multiple systems and data sources.

• Escalate security issues when required to ensure appropriate protection of enterprise data.

• Support the continuous improvement of DLP and Insider Threat capabilities.

Requirements

Must-have

• 3+ years of experience in cybersecurity, information security, security monitoring, DLP, insider threat, or a related field.

• Strong experience in data analysis and security monitoring.

• Solid experience with SIEM platforms and log analysis.

• Strong pattern recognition and analytical skills for identifying suspicious or anomalous activity.

• Hands-on experience with Microsoft Purview DLP.

• Knowledge of Cloud environments and security concepts.

• Knowledge of SaaS platforms and CASB solutions.

• Understanding of insider threat concepts, techniques, and use cases.

• Knowledge of information security principles, controls, and practices.

• Knowledge of concepts, tools, and practices related to computer crime, fraud, and digital investigations.

• Strong problem-solving skills and the ability to analyse complex scenarios involving multiple systems.

• Ability to identify security visibility and control gaps and work with technical teams to remediate them.

• Ability to communicate findings and recommendations clearly to both technical and non-technical stakeholders.

• Advanced English level (C1 minimum).

• Location restricted to Spain, Poland, UK, or Portugal.

Nice to have

• Undergraduate degree in Cybersecurity, Computer Science, Information Security, Digital Forensics, or a related field.

• Certifications such as Certified Computer Examiner (CCE), GIAC Certified Forensic Analyst (GCFA), Certified Computer Forensics Examiner, or equivalent.

• Experience with digital forensics and incident investigation.

• Experience developing or improving threat hunting methodologies.

• Experience creating automated security alerts and high-fidelity detection rules.

• Experience working with Microsoft security and compliance technologies.

• Understanding of banking systems, financial services, and banking operations.

• Experience working in large enterprise or regulated environments.

• Experience with data protection and information governance frameworks.

What we offer

• Remote work from Spain, Poland, the UK, or Portugal.

• Participation in international cybersecurity projects within a major banking environment.

• The opportunity to work with DLP, Insider Threat, SIEM, Cloud, SaaS, and Microsoft Purview technologies.

• A collaborative and multidisciplinary working environment.

• Professional growth and career development opportunities.

• Participation in enterprise-scale and international cybersecurity projects.

• Exposure to advanced security monitoring, threat hunting, and data protection initiatives.

• Working within a highly security-focused and regulated environment.

Company

Being part of THEWHITEAM means joining a company made up of professionals with extensive experience in technology consulting.

We firmly believe that companies and clients set the path to follow in the sector, but that path is built by people. We consider it essential that our organization is based on our greatest asset and added-value differentiator, which is our people.