Sr Manager, Global Investigations - Insider Threat

The Walt Disney Company is seeking a Sr Mgr, Global Investigations - Insider Threat, with experience leading a team of law enforcement, intelligence, or private sector professionals. TWDC’s Insider Threat Program is part of an integrated operational effort designed to provide proactive threat collection, analysis, investigation, and reporting on all facets of insider risks to the Company.

The Walt Disney Company’s Insider Threat Program is managed by Global Security Investigations (GSI), which is a unit in Global Security that falls within the Company’s Global Mission Services Division. The mission of the Insider Threat Program is to protect TWDC and its affiliates critical data and assets from significant economic, reputational, and regulatory costs associated with Insider Threats. This is accomplished by working with key partners and stakeholders to detect, prevent, mitigate, respond to, and recover from any suspected or identified threats posed by our employees who use their authorized access and institutional knowledge to cause harm or damage to the Company.

You will, under the Director, Global Security Investigations, lead the implementation of the new Insider Threat Charter. The Senior Manager will partner with key stakeholders in applying a holistic approach when assessing, investigating, and mitigating incidents and activity that may cause harm or damage to the Company.

You will also lead a team of Insider Threat Investigators while also contributing to the investigations themselves. It is imperative they partner in a collaborative, investigative environment with other internal stakeholders. The Senior Manager, Insider Threat must be able to perform work autonomously with minimal supervision, demonstrate strong emotional intelligence to skillfully interact with partners and leaders at all levels of the organization, oversee a wide range of complex and sensitive employee-related situations, and exhibit superb written and verbal communication skills.

The selected candidate will be required to perform work onsite in Glendale, California at least 4 days a week. There may be occasional travel to both domestic and international TWDC sites.

Essential Functions

• Author Insider Threat Program response strategies, internal SOPs, and technical support documents.
• Implement effective Insider Threat Program policies tailored to the organization’s needs and Disney culture.
• Collaborate with key stakeholders to identify and analyze insider threat risks/vulnerabilities, assign investigative groups, and ensure program alignment with Company objectives.
• Establish collaboration and maintain relationships with government agencies and industry peers to share relevant information and ensure program maturity via benchmarking against industry standards.
• Work closely with key stakeholders to develop and integrate insider threat detection, technical controls/systems, strategies, and capabilities into existing business processes and to identify and analyze insider threat risks and vulnerabilities.
• Find creative ways to leverage, integrate, and correlate data from Human Resources, Employee Relations, and other cross-functional insider risk collaborators to identify potential insider threats.
• Conduct post-incident analysis to identify areas for improvement.
• Prepare and present regular reports to Executives on program effectiveness and critical findings.
• Brief internal customers (e.g., Human Resources, Employee Relations, Legal, Information Technology) and external authorities (e.g., federal law enforcement) on relevant findings on a need-to-know basis determined by the sensitivity of the investigation or as mandated/authorized by the TWDC Legal Team.
• Stay current on industry trends, emerging threats, and best practices related to Insider Threat management by representing the Company at Insider Threat related conferences and associations.
• Lead, guide, and train a team focused on Insider Threat for TWDC while encouraging a culture of continuous learning and development, fostering their professional growth, and enhancing Insider Threat management and analysis skills.
• Function as a subject matter expert (SME) leading Insider Threat program working groups, with a focus on compliance.
• Create investigative plans and execute them using standard investigative techniques in support of all GSI investigations.
• Assist with general investigative work to include, management of investigators, and participating in and managing administrative responsibilities for the team
• Support the Chief Security Officer’s strategy for providing counterintelligence and counterterrorism training to TWDC businesses and approved business partners throughout the enterprise.
• Partner with Enterprise technology Cybersecurity team to oversee, design, and continuously improve data protection solutions, such as data labelling, classification, data loss prevention, alert triage, case management, and related processes.
• Maintain governance over documentation and revise procedures, practices, and policies defining and supporting threat analysis and data protection, as necessary.
• Assist with general investigative work to include

Basic Requirements

• 10+ years of experience conducting investigations and managing the investigative process to include conducting interviews, collecting data and facts, and analyzing to identify trends and/or discrepancies to include:
  • 7+ years of experience in working in Insider Threat, Cyber, Counterintelligence, or closely related fields.
  • 5+ years of experience with Insider Threat Programmatic experience for a multinational company or Government organization.
• 5 + years of experience leading others.
• Bachelor’s degree in a related field or equivalent work experience.
• Working knowledge of intelligence aggregation tools; including review of the output of automated data models to assess and identify potential insider threats.
• Proficient with Microsoft Office: Outlook, Word, Excel, and PowerPoint.
• Excellent analytical and communication skills and a collaborative problem-solver.
• Expert in investigative triage, case management, and report writing.
• Proven record of investigating sensitive, confidential, or criminal matters.
• Strong technical knowledge of cybersecurity concepts, standards, guidelines, and principles.

Preferred Technical/Professional Expertise

• Advanced degree in a related field or equivalent work experience.
• Experience with Data Loss Prevention (DLP), Security Event Incident Management (SIEM) Tools, and Employee Monitoring Solutions.
• Strong understanding of Human Resources/Employee Relations functions and processes.
• Experience developing/analyzing UAM signatures and using User and Entity Behavior Analytics.
• Mental Health and/or Suicide Prevention Training.
• Security/Cyber certification such as SANS, CISSP, CISM, CISA, CRISC, CGEIT, CEH, SEC+, or equivalent preferred.
• Other relevant certifications (e.g., CERT Insider Threat Program Manager/Vulnerability Assessor, GCITP, CCITP F/A, etc.).
• An active U.S. Secret Security Clearance, with the ability for Top Secret Clearance in the future.