Investigations Analytics Manager

The Walt Disney Company is seeking an Investigations Analytics Manager to support The Walt Disney Company Global Security Investigations team, with a focus on our Insider Threat Program. The Insider Threat Program is part of an integrated operational effort designed to provide proactive threat collection, analysis, investigation, and reporting on all facets of insider risks to the Company.

The Walt Disney Company’s Insider Threat Program is managed by Global Security Investigations, which is a unit in Global Security that falls within the Company’s Global Mission Services Division. The mission of the Insider Threat Program is to protect the Walt Disney Company and its affiliates critical data and assets from significant economic, reputational, and regulatory costs associated with Insider Threats. This is accomplished by working with key partners and stakeholders to detect, prevent, mitigate, respond to, and recover from any suspected or identified threats posed by our employees who use their authorized access and institutional knowledge to cause harm or damage to the Company.

The Investigations Analytics Manager will support both Global Security Investigations and the Insider Threat Program. As part of the team, they will partner with key stakeholders in applying a holistic approach when assessing, investigating, and mitigating incidents and activity that may cause harm or damage to the Company.

The Investigations Analytics Manager must be able to perform work autonomously with minimal supervision, demonstrate strong emotional intelligence to skillfully interact with team members and partners, participate in a wide range of complex and sensitive employee-related situations, and exhibit superb written and verbal communication skills.

The selected candidate will be required to perform work onsite in Glendale, California. There may be occasional travel to both domestic and international sites.

Essential Functions

• Conduct proactive, Insider Threat research and analysis to identify potential insider threats, anomalous activity, vulnerabilities, and trends.
• Analyze Insider Threat program datasets to assess and address potential threats.
• Provide tactical analytical support to GSI investigations, to include identifying threat indicators, indicators of compromise, and investigative gaps.
• Document findings suitable for executive-level dissemination to include analysis of GSI investigative metrics.
• Collaborate with the cybersecurity team to leverage and manage relevant tools, recommending technical manipulation of the tools for specific data outputs.
• Direct the manipulation of the tools to ensure accurate, manageable, and actionable results, while understanding the tools capabilities and functionality.
• Use technical experience with tools like UEBA, SIEM, and DLP to implement and interpret the monitoring outputs to reduce false positives and improving Insider Threat detection.
• Adhere to investigation and analytic tradecraft standards, including maintaining confidentiality, objectivity, and timeliness.
• Collaborate with cross-functional teams (HR, cybersecurity, Employee Relations) and key stakeholders to assess Insider Threat risks, support investigations, integrate data, and ensure alignment with investigative priorities.
• Manage and safeguard sensitive data, including case files, employee PII, and intelligence reports.
• Prepare, present findings, and lead briefings to internal clients, collaborators, and executives on relevant findings on a need-to-know basis determined by the sensitivity of the investigation or as mandated/authorized by the TWDC Legal Team. These materials will be viewed and used by the Company’s Senior Executives to security related business practices.
• Stay current on industry trends, emerging threats, and best practices related to Insider Threat and general investigations.
• Benchmark and share insights with external industry and government partners to enhance threat intelligence and investigations.
• Support employee training related to Insider Threat awareness and program initiatives.

Basic Requirements

• 7 + years of experience in data analytics in the disciplines of cyber security, information security, corporate investigations, or related fields.
• Analytical experience with Insider Threat, cyber, and counterintelligence investigations and applicable analytic tools for a multinational company or Government organization.
• Experience analyzing large, complex datasets to detect anomalies and develop risk detection models.
• Experience with Data Loss Prevention (DLP), Security Event Incident Management (SIEM) Tools, Insider Threat Detection platforms and Employee Monitoring Solutions.
• Strong analytical skills, attention to detail, and self-motivation.
• Exceptional written and verbal communication skills for technical and non-technical stakeholders.
• Bachelor’s degree in a related field or equivalent work experience
• Working knowledge of intelligence aggregation tools; including review of the output of automated data models to assess and identify potential insider threats.
• Demonstrate a proven ability to manage multiple projects and prioritize tasks under tight deadlines.
• Proficient with Microsoft Office: Outlook, Word, Excel, and PowerPoint.
• Experience with building analytical dashboards for research, investigations, and reporting.
• Exhibit high integrity and discretion when handling sensitive information.

Preferred Technical/Professional Expertise

• Advanced degree in a related field or equivalent work experience.
• Experience developing/analyzing UAM signatures and employing User and Entity Behavior Analytics.
• Security/Cyber certification such as SANS, CISSP, CISM, CISA, CRISC, CGEIT, CEH, SEC+, or equivalent preferred.
• Other relevant certifications (e.g., CERT Insider Threat Program Manager/Vulnerability Assessor, GCITP, CCITP F/A, etc.).
• Knowledge of creating detection rules and models for anomalous behaviors.
• An active U.S. Secret Security Clearance, with the ability for Top Secret Clearance in the future.