Senior Insider Risk Investigator

Senior Insider Risk Investigator

Macclesfield, UK (3 days on site per week)

About AstraZeneca

AstraZeneca is a global, science-led, patient-focused biopharmaceutical company that focuses on the discovery, development and commercialisation of prescription medicines for some of the world’s most serious diseases. But we’re more than one of the world’s leading pharmaceutical companies. At AstraZeneca, we are pioneering new frontiers by identifying and treating patients earlier, working towards the aim of eliminating cancer as a cause of death.

Come and join our AZ team where you will play a pivotal role in this exciting period of development!!

The Senior Insider Risk Investigator will independently lead the assessment and investigation of complex, sensitive and high-risk insider risk events within AstraZeneca’s Global Cyber Defence function, while providing quality assurance, peer review and guidance across Insider Risk Management casework. Working from alert or referral through to closure, the role will combine advanced technical analysis, business context and proportionate risk assessment to establish what occurred, assess potential impact and provide clear, defensible findings and recommended actions.

The role will lead a varied caseload that may include suspected unauthorised disclosure or transfer of information, inappropriate access, misuse of corporate systems, policy non-compliance, compromised accounts, intellectual property concerns and data handling risks associated with workforce events such as role changes and departures. Cases may originate from security monitoring, operational teams, information incidents, business referrals or other authorised channels.

Key Responsibilities:

• Complex investigations: Lead complex, sensitive, high-profile or multi-jurisdiction insider risk investigations from initial intake and scoping through investigation, findings and closure, including cases that may subsequently support disciplinary, legal, regulatory or law enforcement processes.
• Assessing and prioritising concerns: Assess alerts and concerns raised through security monitoring, colleagues and partner teams. Determine whether further investigation is rationalised based on available evidence, risk, proportionality and defined criteria, and document the rationale for key investigative decisions.
• Investigation planning and analysis: Develop clear investigation scopes, hypotheses and evidence requirements. Build timelines, correlate evidence from multiple sources, identify corroborating or conflicting information, assess alternative explanations and document conclusions with an appropriate level of confidence.
• Technical evidence: Retrieve, preserve, organise and analyse relevant security and business telemetry from sources such as DLP, Insider Risk Management, SIEM, endpoint, identity, cloud, network and collaboration platforms. Maintain appropriate evidence provenance and integrity so that material findings can be traced back to their supporting evidence.
• Cross-functional coordination: Coordinate effectively with Employee Relations, Legal, Compliance, Privacy, Human Resources, DLP, Cyber Security and relevant business teams. Provide objective technical evidence and investigative context to support decision-making
• Investigation boundaries: Maintain a clear distinction between the investigator’s role in establishing technical facts and the responsibility of authorised functions such as Employee Relations, Human Resources, Legal and Compliance to resolve employment, disciplinary, legal or regulatory outcomes.
• Quality and assurance: Establish and maintain high standards for investigation planning, evidence handling, case documentation, analytical reasoning and reporting. Review complex or high-risk investigations and challenge findings where evidence, reasoning or documentation does not adequately support the conclusion.
• Learning and improvement: Identify recurring behaviours, control weaknesses and investigative insights, translating appropriate findings into recommendations for improved detection, prevention, controls and awareness. Share anonymised lessons and investigation techniques across the wider team
• Process and control improvement: Find opportunities to improve insider risk investigation processes, workflows, controls and supporting guidance based on case experience, recurring issues and lessons learned.
• Mentoring and capability: Coach and develop investigators and analysts, provide guidance on complex cases, and help build consistent investigative capability, judgement and standards across the team.
• Measures and reporting: Monitor investigation performance and contribute to regular insider risk reporting for leadership

Requirements:

• Education: Relevant education, professional training or equivalent practical experience, combined with hands on experience in insider risk investigations, security operations, incident response, digital forensics, intelligence, fraud or a related field, including considerable experience leading complex investigations.
• Investigative leadership: Demonstrated track record of independently leading complex and sensitive investigations, exercising sound investigative judgement and reviewing and quality-assuring the work of others.
• Experience in: Insider risk principles, including accidental, negligent, compromised and malicious activity, data ex-filtration, intellectual property risk, inappropriate access, policy violations and third-party or contractor risk.
• Strong knowledge in: Structured investigation methods, including intake, scoping, hypothesis development, timeline analysis, corroboration, evidence handling, root cause assessment and defensible decision making.
• Decision-making: Experience making defensible, proportionate decisions on case acceptance, scope, priority and critical issue under time pressure and uncertainty.
• Technical analysis: Strong experience using security monitoring and investigative tooling to retrieve, organise and analyse technical evidence, including SIEM, DLP, endpoint, identity, cloud, collaboration or user activity monitoring data.
• Written and verbal communication: Strong report writing and briefing skills, with the ability to explain complex technical activity, evidence, confidence, limitations and business risk clearly to technical and non-technical team members, including senior decision makers.
• Stakeholder management: Experience coordinating complex or sensitive work across multiple business and technical functions, maintaining confidentiality and influencing timely, proportionate outcomes without direct authority.
• Quality assurance and mentoring: Experience reviewing investigative work, challenging evidence and conclusions constructively, coaching less experienced investigators or analysts and contributing to consistent investigative standards.
• Process and control improvement: Experience identifying and delivering improvements to investigative processes, playbooks, monitoring, detections, controls, tooling or automation, using operational and investigative insight to support practical and proportionate improvements.
• Querying and automation: Strong experience using query languages to support investigation and analysis, such as KQL or SPL. Experience using scripting or automation technologies such as PowerShell or Python to improve analytical or investigative workflows would be advantageous.
• Adaptability and shared capability: Willingness to maintain knowledge across adjacent Cyber Defence capabilities and contribute to cross-training, knowledge sharing and wider operational priorities where required.
• Preferred certifications: A relevant certification such as ITPM, GCIH, GCFA or another qualification applicable to security investigations or insider risk.

In Office Requirement:

When we put unexpected teams in the same room, we unleash bold thinking with the power to inspire life-changing medicines. In-person working gives us the platform we need to connect, work at pace and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. But that doesn't mean we're not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.

Competitive salary and benefits package on offer!

The successful candidate will have access to a flexible employee benefits fund, including holiday purchase and flexible time off, pension contributions, Share Save Plans, A performance recognition scheme and a competitive, generous remuneration package. 

Date Posted

12-Nov-2026

Closing Date

25-Nov-2026

Our mission is to build an inclusive and equitable environment. We want people to feel they belong at AstraZeneca and Alexion, starting with our recruitment process. We welcome and consider applications from all qualified candidates, regardless of characteristics. We offer reasonable adjustments/accommodations to help all candidates to perform at their best. If you have a need for any adjustments/accommodations, please complete the section in the application form.