CI&I Data Exfiltration Investigator - Tucson, AZ

Date Posted: 2026-04-07

Country:

United States of America

Location:

US-AZ-TUCSON-805A ~ 1151 E Hermans Rd ~ BLDG 805A

Position Role Type:

Hybrid

U.S. Citizen, U.S. Person, or Immigration Status Requirements:

Active and transferable U.S. government issued security clearance is required prior to start date. U.S. citizenship is required, as only U.S. citizens are eligible for a security clearance

Security Clearance Type:

DoD Clearance: Secret

Security Clearance Status:

Active and existing security clearance required on day 1

At Raytheon, the foundation of everything we do is rooted in our values and a higher calling – to help our nation and allies defend freedoms and deter aggression. We bring the strength of more than 100 years of experience and renowned engineering expertise to meet the needs of today’s mission and stay ahead of tomorrow’s threat. Our team solves tough, meaningful problems that create a safer, more secure world.

As a CI&I Data Exfiltration Investigator, you will possess and demonstrate extensive knowledge, training, and experience as it relates to identification and investigation of potential insider threats (InT) within the realm of data exfiltration. You will possess in-depth experience with User Activity Monitoring (UAM), SPLUNK (SIEM) and Endpoint DLP. While your primary focus will be within the data exfiltration arena, you must also possess and demonstrate extensive knowledge of CI principles, have an expert level understanding of potential InT indicators and behaviors, with the ability to rapidly triage and assess multitude of cyber-related behaviors with the objective of distinguishing between actual threats and false positives. Conduct other investigations as necessary, may be required to assist CI&I Investigations Team.

What You Will Do

• Operate independently providing expert-level data exfil investigative capabilities that include, but not limited to:
• Independently plan and conduct Data Exfiltration investigations that result in sound outcomes/determinations, capable of withstanding judicial/administrative scrutiny into noncompliance with Customer regulatory requirements, Company policies and procedures, and violations of the law.
• Write detailed, highly professional reports summarizing investigative steps/actions.
• Conduct a wide range of employee interviews, to include challenging subject interviews of those suspected of wrongdoing.
• Ensure all relevant case artifacts (unless prohibited) are securely stored in the Resolver Case Management System.
• Closely collaborate with other CI&I members, GSS colleagues, and cross-functional partners.
• Collaborate with and provide timely feedback to our partners in Enterprise Services (ES) as it relates to the refinement of tools and processes used in identifying potential indicators of concern.
• For matters involving culpability of cleared employees, ensure cognizant FSOs are provided with necessary investigative details for required adverse information reporting obligations.

What You Will Learn

• You will expand your business acumen and learn about Raytheon’s offensive/defensive solutions to help U.S. government, Allies and Partners defend their national sovereignty and ensure their security.
• How CI&I’s proactive CI initiatives and InT program advances Raytheon’s security culture, program execution excellence, an operational productivity, as well as fosters Customer’s confidence and Raytheon’s competitive advantage.

Qualifications You Must Have

• Typically requires: A University Degree or equivalent experience and minimum 8 years prior relevant experience, or An Advanced Degree in a related field and minimum 5 years experience
• Experience with User Activity Monitoring (UAM), SPLUNK (SIEM) and Endpoint DLP, or similar tools that are utilized in Insider Threat (InT) identification and mitigation.
• Experience in identifying, collecting and analyzing data/metrics for leadership.
• Familiarity with computer operating systems, computer networking and computer vulnerabilities.
• Experience with Microsoft Office and O365.
• Experience working with Core Principle of Cybersecurity - Confidentiality, Integrity, and Availability

Qualifications We Prefer

• Certification by a federal credentialing counterintelligence or investigative agency.
• Prior Law Enforcement Experience.
• Hands-on experience with investigations involving CI, SCI, SAP, and/or ITAR/EAR violations.
• Familiarity with DoD Manual 5205.07 Volumes 1 thru 4.
• Familiarity with DoD 5200.01 Volumes 1 thru 3, and incident reporting process in accordance with DoD 5200.01 volume 3.
• 32 CFR Part 117 National Industrial Security Program Operating Manual
• Familiarity with Computer Forensics methodologies and techniques.

What We Offer

• Our values drive our actions, behaviors, and performance with a vision for a safer, more connected world. At RTX we value: Safety, Trust, Respect, Accountability, Collaboration, and Innovation.

• This position is not eligible for Relocation assistance

Learn More & Apply Now!

• Please consider the following role type definition as you apply for this role. Onsite : Employees who are working in Onsite roles will work primarily onsite. This includes all production and maintenance employees, as they are essential to the development of our products.

As part of our commitment to maintaining a secure hiring process, candidates may be asked to attend select steps of the interview process in-person at one of our office locations, regardless of whether the role is designated as on-site, hybrid or remote.

The salary range for this role is 107,500 USD - 204,500 USD. The salary range provided is a good faith estimate representative of all experience levels. RTX considers several factors when extending an offer, including but not limited to, the role, function and associated responsibilities, a candidate’s work experience, location, education/training, and key skills.

Hired applicants may be eligible for benefits, including but not limited to, medical, dental, vision, life insurance, short-term disability, long-term disability, 401(k) match, flexible spending accounts, flexible work schedules, employee assistance program, Employee Scholar Program, parental leave, paid time off, and holidays. Specific benefits are dependent upon the specific business unit as well as whether or not the position is covered by a collective-bargaining agreement.

Hired applicants may be eligible for annual short-term and/or long-term incentive compensation programs depending on the level of the position and whether or not it is covered by a collective-bargaining agreement. Payments under these annual programs are not guaranteed and are dependent upon a variety of factors including, but not limited to, individual performance, business unit performance, and/or the company’s performance.

This role is a U.S.-based role. If the successful candidate resides in a U.S. territory, the appropriate pay structure and benefits will apply.

RTX anticipates the application window closing approximately 40 days from the date the notice was posted. However, factors such as candidate flow and business necessity may require RTX to shorten or extend the application window.

RTX is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or veteran status, or any other applicable state or federal protected class. RTX provides affirmative action in employment for qualified Individuals with a Disability and Protected Veterans in compliance with Section 503 of the Rehabilitation Act and the Vietnam Era Veterans’ Readjustment Assistance Act.

Privacy Policy and Terms:

Click on this link to read the Policy and Terms