Global Investigations Senior Manager - Insider Threat

The Walt Disney Company (TWDC) is seeking a Global Investigations Senior Manager, Insider Threat, within Global Security Investigations (GSI), with an Insider Threat specialty. TWDC’s Insider Threat Program is part of an integrated operational effort designed to provide proactive threat collection, analysis, investigation, and reporting on all facets of insider risks to the Company.

The Walt Disney Company’s Insider Threat Program is managed by GSI, which is a unit in Global Security that falls within the Company’s Global Mission Services Division. The mission of the Insider Threat Program is to protect TWDC and its affiliates critical data and assets from significant economic, reputational, and regulatory costs associated with Insider Threats. This is accomplished by working with key partners and stakeholders to detect, prevent, mitigate, respond to, and recover from any suspected or identified threats posed by our employees who use their authorized access and institutional knowledge to cause harm or damage to the Company.

The Global Investigations Senior Manager, Insider Threat will, under the Director, Global Security Investigations, participate as a lead investigator, supporting the Insider Threat Program. The Senior Investigations Manager will partner with key stakeholders in applying a holistic approach when assessing, investigating, and mitigating incidents and activity that may cause harm or damage to the Company.

The Global Investigations Senior Manager, Insider Threat must be able to perform work autonomously with minimal supervision, demonstrate strong emotional intelligence to skillfully interact with partners and leaders at all levels of the organization, oversee a wide range of complex and sensitive employee-related situations, and exhibit superb written and verbal communication skills.

The selected candidate will be required to perform work onsite in Glendale, California at least four days a week. There may be occasional travel to both domestic and international TWDC sites.

Essential Functions

• Identify and analyze insider threat risks/vulnerabilities and ensure program alignment with Company objectives.
• Establish collaboration and maintain relationships with government agencies and industry peers to share relevant information and ensure program maturity via benchmarking against industry standards.
• Assist with the authoring of the Insider Threat Program response strategies and technical support documents.
• Work closely with key stakeholders to develop and integrate insider threat detection, technical controls/systems, strategies, and capabilities into existing business processes and to identify and analyze insider threat risks and vulnerabilities.
• Prepare and present regular reports to Executives on program effectiveness and critical findings.
• Brief key stakeholders and external authorities (e.g., federal law enforcement) on relevant findings on a need-to-know basis determined by the sensitivity of the investigation or as mandated/authorized by the TWDC Legal Team.
• Stay current on industry trends, emerging threats, and best practices related to Insider Threat management by representing the Company at Insider Threat related conferences and associations.
• Function as a subject matter expert (SME) leading Insider Threat investigations and program working groups.
• Create investigative plans and execute them using standard investigative techniques in support of all GSI investigations.
• Support the Chief Security Officer’s strategy for participating in counterintelligence and counterterrorism training to TWDC businesses and approved business partners throughout the enterprise.
• Continuously improve and implement data protection solutions, such as data labelling, classification, data loss prevention, alert triage, case management, and related processes.
• Conduct complex investigations into unlawful activity and violations of company policies and procedures efficiently, thoroughly, and professionally.
• Conduct open-source intelligence (OSINT) and internet research to support investigative matters.
• Prioritize multiple tasks and responsibilities in a fast-paced environment while maintaining positive customer/client relations.
• Interface, as necessary, with executives on security and investigative matters.
• Maintain strict discretion and confidentiality regarding assignments and investigations.
• Assist the GSI team with Global Security related events and functions.
• Deliver exceptional, individualized, and attentive customer service to department clients throughout investigations and incidents.
• Foster strong relationships through proactive, hands-on engagement with clients and partners.

Basic Requirements

• 10+ years of experience conducting investigations and managing the investigative process to include conducting interviews, collecting data and facts, and analyzing to identify trends and/or discrepancies to include:
  • 7+ years of experience in working in Insider Threat, Cyber, Counterintelligence, or closely related fields.
  • 5+ years of experience with Insider Threat Programmatic experience for a multinational company or Government organization.
• Bachelor’s degree in a related field or equivalent work experience.
• Working knowledge of intelligence aggregation tools; including review of the output of automated data models to assess and identify potential insider threats.
• Proficient with Microsoft Office: Outlook, Word, Excel, and PowerPoint.
• Excellent analytical and communication skills and a collaborative problem-solver.
• Expert in investigative triage, case management, and report writing.
• Proven record of investigating sensitive, confidential, or criminal matters.
• Strong technical knowledge of cybersecurity concepts, standards, guidelines, and principles.

Preferred Technical/Professional Expertise

• Advanced degree in a related field or equivalent work experience
• Experience with Data Loss Prevention (DLP), Security Event Incident Management (SIEM) Tools, and Employee Monitoring Solutions.
• Strong understanding of Human Resources/Employee Relations functions and processes.
• Experience developing/analyzing UAM signatures and using User and Entity Behavior Analytics.
• Mental Health and/or Suicide Prevention Training.
• Security/Cyber certification such as SANS, CISSP, CISM, CISA, CRISC, CGEIT, CEH, SEC+, or equivalent preferred.
• Other relevant certifications (e.g., CERT Insider Threat Program Manager/Vulnerability Assessor, GCITP, CCITP F/A, etc.).
• An active U.S. Secret Security Clearance, with the ability for Top Secret Clearance in the future.