Insider Threat & Cyber Investigations Lead

Details

Airbnb was born in 2007 when two hosts welcomed three guests to their San Francisco home and has since grown to over 5 million hosts who have welcomed over 2 billion guest arrivals in almost every country across the globe. Every day, hosts offer unique stays and experiences that make it possible for guests to connect with communities in a more authentic way.

Responsibilities

• Conduct high-risk, complex insider threat investigations involving cybersecurity, financial misconduct, intellectual property theft, unauthorized modifications, engineering production abuse, and data exfiltration.
• Investigate identified insider threat cases escalated from the Information Security Engineering team, including financial misconduct, engineering production abuse (such as code manipulation, unauthorized system modifications, data sabotage), intellectual property theft, unauthorized data exfiltration, and legal escalations involving executive personnel.
• Conduct structured investigative interviews with subjects and stakeholders to validate findings and gather additional intelligence.
• Collaborate with engineering teams for forensic collection of digital evidence from endpoints (Windows, macOS, Chrome OS), cloud storage, and mobile devices (iOS, Android).
• Perform custom high-severity data deletions and secure asset retrieval in compliance with legal, regulatory, and corporate policies.
• Perform log analysis and event queries across enterprise systems (Windows Event Viewer, MacOS Console, Chrome OS logs, cloud platform logs like AWS, Azure, GCP, enterprise applications and security logs).
• Analyze structured and unstructured data to correlate insider threat behaviors and support investigation findings.
• Utilize SQL and other queries to extract forensic evidence from company databases, endpoints, and cloud storage.
• Ensure investigations comply with employment law, corporate policies, data privacy regulations, and commercial legal frameworks.
• Collaborate with Legal, HR, Privacy, and Compliance teams to assess corporate risk, legal exposure, and remediation strategies.
• Provide clear, structured briefings on high-profile cases to executive leadership and security teams.
• Lead post-mortem reviews to improve investigative methodologies.

Requirements

• 10-12 years experience in insider threat investigations, security, digital forensics, or related industries.
• Proven experience conducting high-risk, legally sensitive investigations involving corporate executives and critical business functions.
• Strong expertise in Windows, MacOS, and Chrome OS forensic tools.
• Competency in SQL-based forensic data correlation and behavioral anomaly analysis.
• Strong employment and commercial legal acumen with experience in workplace investigations and regulatory compliance.

Technical Proficiency

• Expert in digital forensic tools.
• Advanced knowledge of Windows Event Viewer, MacOS Console, Chrome OS system logs.
• Strong expertise and skills in investigating cloud environments and Kubernetes.
• Experience with high-severity data deletion and asset retrieval.
• Effective skill in conducting investigative interviews and communicating findings with legal, HR, and security teams.

Preferred Certifications

• Sans GIAC, GCFA, or GCFE (Advanced Digital Forensics)
• CISSP
• AWS/Google/Azure Security certifications
• CompTIA Cloud+
• Kubernetes Security or Fundamentals

Location

• Remote - USA (Must reside in a state with Airbnb registered entity; occasional office/offsite attendance possible)

Compensation and Benefits

• Base pay range: $154,000 — $192,000 USD
• May be eligible for bonus, equity, benefits, and Employee Travel Credits.

Commitment

Airbnb values inclusion, belonging, and diversity and encourages all qualified individuals to apply. Disability accommodations are available upon request.