I recently hosted an "Ask Me Anything" with Rachel Kang, Senior Security Investigator on the Insider Risk team at Microsoft, to demystify a field that a lot of government people are drawn to, especially those coming from intelligence, counterintelligence, and law enforcement backgrounds. Before Microsoft, Rachel worked in Insider Risk at OpenAI, where we worked together, and before that she spent five years in digital forensics and incident response at Aon, after getting her start through a cybersecurity fellowship at Carnegie Mellon. Rachel was upfront that she did not come from government, so she spoke from the hiring side: what the job looks like day to day, what teams look for, and what she has seen from the government folks she works alongside. Since I did Insider Risk at both Tesla and OpenAI, the group got a bit of a two-for-one!
(Sidenote: Rachel's comments reflect her own views and experience, not those of Microsoft, OpenAI, or Aon.)
Here is the breakdown of our conversation:
What Insider Risk Work Looks Like Day to Day
How cases start. Most cases begin in one of two ways. Either tooling flags something, like someone downloading a lot of files, sending things to a personal email, or poking into things that have nothing to do with their job, or a partner team such as a manager, HR, or another security team refers something over. From there, the job is figuring out whether something is real, whether it was done on purpose, and how big it could get.
Most of it is not espionage. Yes, spies inside companies do happen. But most of what Rachel sees comes down to poor security hygiene or things done without bad intent: someone emailing themselves a file to finish at home, or dropping something into an unsanctioned tool to make their work easier.
Scoping is most of the job. When something is worth digging into, Rachel scopes it by looking at what someone accessed, what they downloaded, and where it went, then builds a timeline. If you have ever done pattern of life work, it is very similar, just with company logs.
Legal and HR are involved in everything. You cannot read someone's email or look at content just because you want to. Teams must follow strict privacy laws and get legal approval. Most employees never filled out an SF-86, and there is no polygraph, so their assumption of privacy is much higher. You can look only at what happened on company systems, and ideally only as much as you need to.
How cases end. Interviews happen, but they are not adversarial. If it was a mistake, the answer is coaching, training, and education. If a broken process caused it, the team works with product teams to fix the process. If it was intentional, it goes to HR and legal. Most cases land in the first two buckets.
The building half. The other half of Rachel's job is building: detections that catch things earlier, tools for her team, and lately a lot of AI agents that take on the tedious parts of the work. In her words, if you like figuring out what happened, digging through logs, and making a story out of it, you would probably like this role.
My addition. People forget how much of Insider Risk is helping people have better data hygiene. At Tesla, one of my responsibilities was getting interns working on sensitive programs to stop doing things that put company IP at risk, which was a fun challenge!
Which Government Backgrounds Fit
Rachel's view is that all of them can work. The real question is which parts of the job you would be good at right away, and which parts you would need to adjust to or unlearn.
Targeting officers. You would likely pick this up very quickly. Scoping a case means pulling data from many different logs to figure out what someone did and when, which is the same line of thinking. The difference is a much narrower scope: you're using data from company systems only, and a lot you are not allowed to look at, so you have to get creative.
Case officers. You're probably great at interviews, reading people, building rapport, and picking up on when someone is holding something back. Rachel also sees case officers as natural at getting buy-in from HR and legal, which is a much bigger part of the job than most people expect.
Counterintelligence. CI folks know how foreign services operate, which a lot of tech teams do not, and it matters more than you would think. Tech employees get approached all the time, and almost every company is dealing with the North Korean IT worker issue. Her one caution: do not treat every case like espionage. Most of it is people being careless, and if you go in suspicious of everyone, people stop talking to you.
Law enforcement. Case building carries over directly, along with daily documentation and handling evidence in line with chain of custody.
Describe what you did, not your title. A hiring manager will not understand "targeting officer supporting foreign intelligence." They would rather hear that you investigated individuals across multiple data sources, worked this many cases, and briefed senior leadership. It is the same work, and adjusting the wording goes a long way.
Watch your words. Rachel hears peers slip in words like subject, target, or asset. In a company, those sound like surveillance and make people nervous. The people you are looking at are employees, your peers, the person sitting next to you.
My addition. Coming out of government, a lot of people focus on where their skills fit and how to get the job, and less on how the role affects the people around them. In Insider Risk, relationship management, trust building, care with how you talk about things, and protecting people's privacy are all key, and you will do a TON of cross-functional work. If you loved working across offices and teams in government, that will serve you very well here.
How Technical You Need to Be, and Which Certifications Matter
You must be comfortable with data, but you don't need to be an engineer. The biggest asset Rachel sees in people who join from government is the ability to look at query results and tell what is going on. Do you know what a sign-in log can tell you and what it cannot? Do you notice when something looks a little too clean?
What to skill up on: SQL or KQL. KQL is what Microsoft uses, and these languages power a lot of security tools. There are plenty of free beginner modules, and you do not have to be great at it. Rachel joined Microsoft without knowing any KQL and picked it up as the job demanded. She is studying for her CISSP right now and learning networking from scratch, so this is a continuous game for everyone.
AI is changing the technical bar. A lot of the queries Rachel used to write by hand, she now writes with AI or hands to agents she built. The technical parts are getting easier for everyone, but you still need someone who can tell whether the answer is right.
Certifications. No one cert will get you hired, and not having one will not knock you out. If you want one, Rachel suggested:
--> Security+, a cheap, solid baseline that is already required for a lot of DoD roles
--> CFE (Certified Fraud Examiner), if you come from an investigations background
--> CERT Insider Threat Program Manager, which Rachel holds, offered through Carnegie Mellon, and a good fit if you want the full insider risk mindset and eventually to manage a program
--> CCITP through DoD, though spell out the full name on your resume, because recruiters will not know the acronym
Read this before your interview. CERT at Carnegie Mellon publishes a free Common Sense Guide to Mitigating Insider Threats. If you read one thing before an interview, Rachel recommends this one.
My additions. If you want to skill up without a certification, there are lots of options. I took DataCamp's SQL classes and found them really useful, LinkedIn Learning has courses, and both Anthropic and OpenAI offer classes on AI. Which brings me to my biggest piece of advice for anyone in a job search right now: get smart on AI. You do not need to know how it is built, but get comfortable using it and find use cases for it in your own life. Meal plans, grocery lists, tweaking recipes for the week, whatever it is, just start playing with it. There is no job out there right now where they will not want to know you are comfortable with AI.
Agentic Footprints: Where the Field Is Heading
Rachel wanted to emphasize this one. Almost everyone at a tech company now uses AI agents every day, and those agents do real things with a person's access: reading files, sending emails, pushing code. What took a person hours takes an agent seconds.
So the field is shifting from human footprints to agentic footprints. What did the person do? What did their agent do? Did that agent call another agent that called another agent, and can you trace the lineage? Did the person even mean for it to happen, or is it a product issue? The logging for all of this is still catching up as we speak.
If you want to stand out, get comfortable using these tools yourself. You do not need to build them, but if you know how they work and what footprints they leave, you will be way ahead.
Job Security and Career Growth
Rachel was honest that security is not immune to tech layoffs, and it is a different deal from federal service. That said, Insider Risk tends to matter more when a company is going through change, because that is when risk spikes, and every company has data worth protecting.
My addition. Government is not as reliable as it once was either. And the first job out of government is the hardest one to get. Once you have a role like Insider Risk at a big company on your resume, the next pivot gets a lot easier. I have seen this over and over.
Growth paths. Rachel sees a few directions:
--> Stay on the individual contributor (IC) investigator track and move up to senior, principal, or staff level, working the hardest cases
--> Move into detection engineering, building tools and AI agents that help other teams
--> Use it as a launchpad into trust and safety, security leadership, or privacy
Because Insider Risk touches HR, legal, security, and the business, you get to know people across all those areas quickly, which opens a lot of doors. Rachel's own goal is to eventually move beyond the IC role and help shape and lead a program, especially around AI, since very few people have done both the hands-on investigative and technical work and the advising side.
My addition. Insider Risk is still a developing field. Small companies and startups tend not to have a team until they reach a certain size, so with all the churn and growth in industry right now, I see new teams being stood up and existing teams growing. It is not just tech, either. A former colleague of mine does this work in the pharmaceutical industry, where keeping company secrets is paramount.
How Insider Risk Differs Across Companies
Big and specialized vs. small and scrappy. At Microsoft, teams are established and specialized, so people are just investigators or just on detections, and a big part of networking internally is figuring out who does what. At OpenAI, things moved fast, you did a bit of everything (investigations, detections, policy), and what you protected was very specific, like model weights.
Insert yourself into conversations. Rachel makes a point of joining conversations she does not strictly need to be in, whether that is learning what enterprise security is working on or partnering with the governance, risk, and compliance (GRC) team on policies that could prevent repeat behavior. When she has a beer or a cocktail with those teams, she makes sure they understand her world, because there can be a perception that Insider Risk is all surveillance and witch hunts. The more people get to know her, the more they see the benefit of helping each other.
My additions. At Tesla, I focused mostly on prevention (training, awareness, and policies) and worked closely with the investigations team. Two things made it very different from OpenAI:
What you are protecting. At Tesla, much of it lived in the physical world, like batteries and new vehicle models. Physical things leave trails, so that's something you can pull on. At OpenAI, it was far more nebulous, and you were dealing with world-class AI researchers, so the technical knowledge you needed was head and shoulders above Tesla.
How established the program is. Tesla had years to build its program. Approved tools for employees across the company were locked down and policies were set, which made it much easier to figure out what people did. At OpenAI, we were building it, and it was the Wild West in terms of what employees were allowed to use when we got there, which made it much harder to put the picture together.
So when you look at roles, ask: How established is the company? How long has the Insider Risk team been around? How technical is it? Are you protecting something physical, or digital information?
Culture Shift: Mission and Privacy
Mission. In government, the mission is the whole point. In a company, the business exists to make money, and Insider Risk protects the business, its people, and its customers' data. Some people find that feels less meaningful at first. Rachel takes a lot of pride in customers being able to trust that their data is handled safely.
My addition. Protecting US companies' intellectual property is also protecting national security. That is how I thought about it, and there is real continuity there.
Privacy. In government, depending on your role and clearance, you give up a lot of privacy. In the private sector, you will not know when employees travel to certain locations, and you will not have phone records or financial data. You are mostly limited to what people did on their work computers, which can feel like working with one hand tied behind your back after being in government.
Job Titles to Search, Bridge Roles, and Remote Work
Titles to search. If you are breaking in, analyst roles are a good place to start: Insider Risk Analyst or Insider Threat Analyst, at big tech companies and at defense contractors. Security Investigator and Corporate Investigator roles exist too, though they may take a few years of experience first.
Bridge roles. If you do not see the right Insider Risk role, trust and safety is a great segue. So is threat intelligence, which means tracking who is coming after the company from the outside (nation-state groups, criminal groups, ransomware crews) and studying how they operate, so defense teams can prepare. Rachel called it the closest thing in tech to an intelligence analyst job in government, and it overlaps with Insider Risk more than you would think, especially when foreign governments try to recruit employees or get fake workers hired.
Remote work. It depends on the company. A lot of tech has moved back to hybrid, and some large companies are back to five days a week in the office. The work itself is very remote-friendly, though, since much of it is looking at data and writing reports. Rachel is in San Francisco, her team is spread across the US, and she travels to meet other teams because relationship building is better in person. A distributed team also means a follow-the-sun model, where someone on the East Coast can pick up an incident at 6 AM Pacific.
My addition. If the company lists only three cities on a posting, do not take that as a hard no if they have an office near you. It's always worth a conversation!
Where Government People Excel, and Missteps to Avoid
Strengths Rachel sees every day:
--> Making a decision without having all the information. In tech, many people wait for perfect data. Government folks decide and own it, and Rachel has adjusted her own risk calculus from watching them.
--> Discretion. Knowing what not to say and who does not need to know is less common in a company where everything lives in Slack or Teams.
--> Writing for leadership. Bottom line up front, short and clear. Executives love it, and a lot of tech people who like to go very deep have to unlearn that.
My additions. Relationship building is a big one: government people know how to figure out who does what and get in the door. And as I always say, people coming out of government are like water. Water finds a way!
Is that not the case in tech? One attendee asked this, and my view is that people in tech can get pretty stovepiped in their own piece, take no for an answer easily, and not always see how their piece fits into the bigger picture. Rachel agreed it varies by person and level and the strongest partners she’s worked with, at any level, have a ‘what can we do to help each other’ mindset.
Missteps Rachel has seen:
--> Treating every case like espionage. Most cases are purely mistakes, and coming in hot erodes trust. Some of the most impactful cases came from employees reporting things because they trusted the team, not from detections.
--> Running interviews like interrogations. The person you are interviewing is usually still your coworker the next day.
--> Collecting too much data. The government instinct is to gather as much as you can, but looking at more than you need is a privacy violation, and legal will tell you so every step of the way.
Good Days and Bad Days
Good days. When an investigation finally clicks. When Rachel meets a team she has never worked with who has the one thing that makes her life easier. And when a detection she built catches something early, before it becomes a big incident, which is a sign of a healthy program: you take the lessons from one incident and catch the next one earlier in the kill chain.
Bad days. When teams cannot give her what she needs because of bureaucracy, or she is waiting on privacy approval to look at something. You cannot work in silos in this job, and that part does not get easier.
My additions. A theme that has come up a lot in my coaching lately: your colleagues do not work for you. Responding to you is part of their job, along with 10 or 20 other things, so the relationships you build with your counterparts are paramount. My favorite days in insider risk were when the light bulbs went off for the interns I was training, or when someone in an interview owned what happened and we worked together on a fix. And one thing that will feel different coming from government: you can see metrics of your impact, which feels great and is not easily found in government. "Read with interest" just doesn't hit in the same way ;-)
Bottom Line
Rachel's throughline was that Insider Risk is far more about trust than suspicion. Most of the job is helping people do the right thing, building relationships across HR, legal, and security, and looking only as much as you need to. Government backgrounds fit well, especially targeting, case officer, CI, and law enforcement experience, as long as you describe what you did in plain language and leave the surveillance vocabulary behind. Get comfortable with data, learn a little SQL or KQL, and get very comfortable with AI, because agentic footprints are where this field is heading.
Thank you, Rachel, for being so generous and candid with your time!
———
If you want a tool built specifically for this transition, MissionPivot™ can help you translate your government experience, pressure-test your resume against the roles you’re targeting, and figure out what to do next.
