Track Lead - Data Loss Prevention,Palo Alto Firewalls

Job Summary

Job Summary : We are seeking an experienced Insider Risk Specialist to join Marvell\'s Security Operations team. This is a high-impact, analytically driven role at the intersection of behavioral analysis, data protection, threat intelligence, and investigation. You will be a key operator in our Insider Risk Program — identifying, analyzing, and mitigating threats that originate from within the enterprise.

Key Responsibilities

Job Responsibilities : Threat Signal Analysis & Data Monitoring · Continuously monitor and analyze threat signals from SIEM, DLP, endpoint detection, email security, cloud access, and HR/behavioral data sources to identify anomalous and high-risk activity. · Correlate multi-source data — including access logs, data movement telemetry, badge records, and productivity signals — to build a holistic risk picture for individuals and populations. · Develop, tune, and operationalize detection use cases, alerting thresholds, and behavioral baselines to reduce noise and improve signal fidelity. · Build and maintain dashboards, metrics, and trend reports that communicate program effectiveness to leadership. DLP Triage & Processing · Own the end-to-end triage lifecycle for DLP alerts across endpoints, cloud environments (M365, Google Workspace, AWS), and email — from initial alert review through disposition and escalation. · Classify and prioritize incidents by sensitivity, intent, and potential business impact; apply consistent triage frameworks to ensure efficient and defensible case handling. · Identify policy gaps, false-positive patterns, and emerging exfiltration vectors; recommend DLP policy refinements to reduce risk while minimizing friction for legitimate business activities. · Maintain accurate, timely case records in the case management system, ensuring chain-of-custody integrity for all evidence. Investigations · Lead and conduct end-to-end investigations of potential insider risk incidents — including IP theft, data exfiltration, policy violations, sabotage, and pre-departure data staging. · Collect, preserve, and analyze digital evidence from endpoint forensics, cloud storage, communication platforms, and HR systems in accordance with legal and evidentiary standards. · Produce comprehensive, well-structured investigation reports documenting findings, timelines, impact assessments, and recommended actions suitable for legal, HR, and executive audiences. · Manage multiple concurrent active investigations with rigor, discretion, and appropriate urgency. Subject Interviews · Plan and conduct structured subject interviews in coordination with Legal, HR, and business leadership — applying established interview methodologies tailored to insider risk contexts (e.g., cognitive interviewing, motivational interviewing). · Conduct witness interviews to gather corroborating information and context; document findings with accuracy and impartiality. · Maintain composure and objectivity in sensitive, adversarial, or emotionally charged interview settings; protect subject dignity while gathering actionable intelligence. Legal Collaboration & Case Adjudication · Partner closely with Legal and Employment Law to ensure investigations comply with applicable labor laws, privacy regulations, and evidentiary standards across all operating jurisdictions (U.S., India, Israel, EU, and Asia-Pacific). · Present investigation findings, evidence packages, and risk assessments to Legal and HR for case adjudication — including decisions on disciplinary action, civil litigation, criminal referral, or administrative closure. · Support the preparation of materials for regulatory inquiries, litigation holds, and law enforcement cooperation when required. · Track and document case dispositions and lessons learned to continuously improve program policy and legal defensibility. Threat Intelligence & Risk Program Development · Develop and maintain an insider threat intelligence capability — tracking threat actor TTPs relevant to the semiconductor industry, including economic espionage, nation-state recruitment, and supply chain manipulation. · Produce threat intelligence products (briefings, advisories, risk reports) for security leadership, HR, and business unit heads to inform enterprise risk decisions. · Monitor the external threat landscape, including geopolitical developments, export control changes, and industry-specific threat reporting from CISA, FBI, and

Skill Requirements

Skill Requirement : Required · 7+ years of progressive experience in insider threat, corporate investigations, counterintelligence, digital forensics, or a closely related security discipline. · Demonstrated expertise with DLP platforms (e.g., Microsoft Purview, Symantec DLP, Forcepoint, Zscaler) including policy tuning, triage workflows, and incident adjudication. · Proficiency with SIEM platforms (XSIAM, Splunk, Microsoft Sentinel, or equivalent) and UEBA/UAM tools for behavioral analysis and anomaly detection. · Hands-on experience conducting complex civil or corporate investigations — from initial tip through evidence collection, interviews, reporting, and legal referral. · Experience conducting structured subject interviews and witness interviews in a corporate or law enforcement context. · Proven ability to work cross-functionally with Legal, HR, IT, and senior leadership in a highly confidential environment. · Strong written and verbal communication skills; ability to translate complex technical findings into clear, actionable narratives for non-technical audiences. · Demonstrated knowledge of applicable privacy and employment laws across multiple jurisdictions (particularly U.S., EU GDPR, and Asia-Pacific regimes). · Hands-on experience operating AI-powered insider risk or UEBA platforms — including use case configuration, cohort/module development, and risk score tuning — with a clear understanding of how AI-assisted detection outputs translate into investigation workflows. Preferred · Prior experience in the semiconductor, defense technology, or critical technology sectors with heightened awareness of IP protection. · Experience in or with federal law enforcement, intelligence community, or military counterintelligence. · Background in threat intelligence production (STIX/TAXII, indicator management, adversary TTP analysis). · Familiarity with digital forensic tools (EnCase, FTK, Cellebrite, or equivalent) and e-discovery platforms. · Experience with SOAR platforms and automation of investigation workflows. · Knowledge of MITRE ATT&CK; for Enterprise and Insider Threat frameworks. · Experience using generative AI / LLM tools (e.g., Microsoft Copilot, Claude, or similar) to accelerate investigative analysis, summarize case evidence, draft reports, or build detection logic. · Familiarity with the ethical, legal, and governance considerations of deploying AI in a workforce monitoring context, including explainability requirements and bias mitigation. Education & Certifications · Bachelor\'s degree in Cybersecurity, Criminal Justice, Intelligence Studies, Computer Science, or a related field; advanced degree a plus. · Relevant professional certifications valued: CISSP, CISM, CFE (Certified Fraud Examiner), CFCE, EnCE, CCITP (CERT Insider Threat Professional), or equivalent.

Other Requirements

Other Requirement : You think like an investigator AND a data analyst — equally comfortable in a boardroom briefing and deep in SIEM query language. You harness AI as a force multiplier — you know how to configure detection use cases, build meaningful cohorts, and tune behavioral modules without losing sight of the human judgment that makes investigations defensible. You operate with impeccable judgment and discretion — you understand that access to sensitive data and AI-assisted monitoring is a privilege with strict ethical obligations. You are proactive, not reactive — you identify and reduce risk before incidents occur. You build trust across organizational boundaries — Legal trusts your evidence, HR trusts your process, and business leaders trust your judgment. You thrive in ambiguity and complexity — insider risk rarely comes neatly packaged, and you know how to structure uncertainty into defensible conclusions.