Detecting Insider Misuse of Sensitive Data

Insider misuse, where someone with legitimate access looks at records they have no business reason to see, is one of the hardest privacy violations to catch. Detections that are too broad drown investigators in alerts; detections that are too narrow miss real abuse.

In industry

At Amazon Healthcare Security I was the principal engineer for a large-scale insider-threat (data-misuse) detection capability for regulated healthcare data:

• an offline simulation framework that validates candidate detections against historical access patterns before deployment,
• role-aware suppression that cut projected investigator workload by an order of magnitude, and
• cross-system identity resolution, correlating identities across systems that were never designed to talk to each other.

This builds on my incident-response work at Meta, where variant analysis turned individual privacy incidents into detections and preventive controls for whole classes of problems.

This page describes my role at the level of my public CV; it contains no confidential employer information.