DLP Engineer

• Design, implement, configure, and administer

(e.g., Microsoft Purview DLP, Symantec/Broadcom, Forcepoint, Trellix, Netskope, Zscaler) across endpoint, network, email, web, and cloud channels, ensuring alignment with industry regulations and standards

• Build, test, and deploy

- custom classifiers, regular expressions (Regex), keyword dictionaries, Sensitive Information Types (SITs), Exact Data Matching (EDM), Indexed Document Matching (IDM), and document fingerprinting - including scoped policy targeting, rule conditions, exceptions, and enforcement actions (audit, block, notify, restrict)

• Design, publish, and manage

(Microsoft Purview Information Protection / MIP): label taxonomy design, label policies and scoping, encryption and content-marking settings, container labels for Teams/SharePoint/Microsoft 365 Groups, and label-based DLP policy conditions

• Configure and operate

at scale - client-side and service-side auto-labeling policies for Exchange, SharePoint, and OneDrive; simulation mode testing, tuning label-match accuracy with SITs and trainable classifiers, and monitoring label adoption, label analytics, and mislabeling trends

• Enforce downstream protection based on labels - label-driven DLP rules, conditional access to labeled content, and label inheritance/handling in AI tools (e.g., ensuring Copilot and other GenAI assistants honor sensitivity labels and encryption on protected content)
• Perform continuous

: analyze DLP events, validate true vs. false positives, document findings, and iteratively refine detection to improve accuracy and reduce alert noise

• Manage the DLP platform end to end - agent deployment, upgrades, health monitoring, coverage gap analysis, and maintenance of management/detection server infrastructure
• Design and build automated workflows using

for DLP alert routing, enrichment, user notifications, approval workflows, incident ticket creation (ServiceNow/Jira), automated remediation actions, and compliance reporting processes

• Extend DLP coverage and governance to

, using Purview DLP for AI apps, browser/endpoint controls, and CASB policies to prevent data leakage through prompts, uploads, and AI-generated outputs

• Integrate DLP tooling with the broader security and productivity ecosystem - SIEM/SOAR (Splunk, Microsoft Sentinel), email gateways, proxies, CASB, Active Directory / Entra ID, CMDB, Insider Risk Management, and

(including Copilot and Claude enterprise integrations) for alert triage assistance, event summarization, and reporting automation

• Write and maintain

(PowerShell, Python, REST APIs, Graph API) for policy deployment, dictionary and user-ID updates, health checks, and scheduled compliance reporting

• Support

- scanning file shares, databases, SharePoint, OneDrive, Teams, and cloud repositories to locate, classify, and protect sensitive data

• Act as

: investigate potential data exfiltration, coordinate containment and remediation with SOC/IR teams, and contribute DLP telemetry to insider threat monitoring

• Write and optimize

across Microsoft Sentinel, Defender XDR Advanced Hunting, and Purview audit logs to investigate DLP incidents, hunt for exfiltration behavior, correlate DLP/label/user activity, and build custom analytics rules, dashboards, and workbooks

• Develop

related to the data protection program's status, performance, and maturity (policy coverage, alert volumes, false-positive rates, violation trends) for leadership, audit, and compliance stakeholders; maintain runbooks, SOPs, and architecture documentation

• Partner with legal, privacy, compliance, and business data owners to translate regulatory requirements (

) into enforceable technical controls, including AI acceptable-use enforcement

• Stay current with industry trends and advancements in data security and DLP technologies - including developments in

• Bachelor's degree in

, or a related field - or equivalent practical experience

• 3-5 years of experience in information security / security engineering, including 2+ years of hands-on DLP administration and engineering in an enterprise environment
• Proven hands-on expertise with at least one major

: Microsoft Purview DLP, Symantec/Broadcom DLP, Forcepoint DLP, Trellix DLP, Netskope, or Zscaler

• Hands-on experience with

: label taxonomy and policy design, service-side and client-side auto-labeling, simulation/tuning, trainable classifiers, encryption and content-marking configuration, and integrating labels with DLP policy enforcement

• Working experience building automation with

(flows, connectors, approvals, HTTP/API actions) in a security or IT operations context

• Hands-on

(Copilot / Copilot Studio plugins, Claude and Azure OpenAI API integrations, custom Power Platform connectors), CASB integrations, and Graph API/webhook-based event feeds - including authentication setup (OAuth, service principals, API keys), permission scoping, and connector health monitoring

• Exposure to securing and integrating

; understanding of prompt-level data leakage risks

• Working knowledge of

- writing and optimizing queries in Microsoft Sentinel, Defender Advanced Hunting, and Purview Audit/Activity Explorer to investigate DLP alerts, hunt for data exfiltration patterns, correlate label/DLP events, and build custom detections, workbooks, and reports

• Proficiency in writing

for sensitive data pattern detection and content inspection rule development

• Scripting skills in

; comfort with REST and Microsoft Graph APIs

• Strong grasp of data protection concepts: classification, data-at-rest/in-motion/in-use controls,

• Solid networking fundamentals (TCP/IP, HTTP/S, SMTP, TLS, DNS, proxies) and understanding of how data moves across email, web, endpoint, and cloud channels
• Proficiency with the

(Exchange Online, SharePoint, OneDrive, Teams), Entra ID / Active Directory, and Windows/Linux administration

• Experience in DLP alert triage, incident investigation, and collaboration with SOC/IR teams
• Knowledge of industry regulations and standards such as

and their implications for DLP policy design and enforcement

• Strong analytical and problem-solving skills, with the ability to evaluate risks and develop controls to mitigate them
• Excellent communication and interpersonal skills, with the ability to work effectively with both technical and non-technical stakeholders

•