[Hiring] Manager, Insider Trust @Chainlink Labs

Role Description

The Manager, Insider Trust will lead Chainlink Labs’ Insider Trust function while remaining directly involved in technical investigations and detection development. This player-coach role is responsible for protecting sensitive data, investigating potential insider risk, and strengthening our ability to identify and address concerning activity.

• Lead, develop, and mentor the Insider Trust team.
• Direct and conduct investigations involving sensitive data, systems, and workforce activity.
• Build and improve detections, monitoring, and escalation workflows for insider risk.
• Ensure investigations are timely, proportionate, well documented, and supported by defensible evidence.
• Partner with Legal, People, IT, and Security throughout the investigation and response lifecycle.
• Identify control gaps and translate investigative findings into lasting technical and process improvements.
• Establish metrics that demonstrate program effectiveness, investigative quality, and detection coverage.
• Communicate sensitive findings clearly to both executive and working-level stakeholders.

Qualifications

• 7+ years of experience in insider risk, detection engineering, security operations, incident response, digital forensics, data protection, threat hunting, or a related security field.
• 2+ years leading an insider risk, investigations, or closely related security team.
• Demonstrated ability to lead a team while remaining hands-on in technical investigations and detection development.
• Experience managing the full investigation lifecycle, including scoping, evidence collection, timeline development, analysis, documentation, escalation, and lessons learned.
• Strong knowledge of digital forensics, evidence preservation, chain of custody, incident-response coordination, and case management.
• Experience partnering with Legal and People teams on sensitive workforce investigations.
• Sound understanding of the legal, privacy, confidentiality, and employee-relations considerations associated with workforce investigations.
• Experience working in software, financial services, or another industry that handles highly sensitive data.
• Strong written and verbal communication skills, sound judgment, and the ability to operate discreetly in high-trust situations.

Requirements

• Experience working in a remote-first and globally distributed company.
• Experience investigating data movement across email, cloud storage, collaboration platforms, source-code repositories, build systems, artifact stores, browsers, AI tools, removable media, and unmanaged or partially managed devices.
• Hands-on experience with SIEM, DLP, or endpoint telemetry.
• Experience developing queries, analytics, or automation to identify and investigate suspicious behavior.
• Experience establishing investigation playbooks, escalation criteria, program metrics, and detection coverage.
• Experience leading projects, reviewing technical designs, and mentoring engineers or investigators.
• Working knowledge of blockchain technology, including hardware wallets and signing operations.

Benefits

• All roles with Chainlink Labs are global and remote-based.
• We ask that you try to overlap some working hours with Eastern Standard Time (EST).
• We carefully review all applications and aim to provide a response to every candidate within two weeks after the job posting closes.
• The closing date is listed on the job advert, so we encourage you to take the time to thoughtfully prepare your application.
• We want to fully consider your experience and skills, and you will hear from us regarding the status of your application shortly after the closing date.

Commitment to Equal Opportunity

Chainlink Labs is an equal opportunity employer. All qualified applicants will receive equal consideration for employment in compliance with applicable laws, regulations, or ordinances. If you need assistance or accommodation due to a disability or special need when applying for a role or in our recruitment process, please contact us via this form.