Data Loss Prevention - Engineer

Senior Data Loss Prevention (DLP) Engineer

Position Summary

We are seeking an experienced Data Loss Prevention (DLP) Engineer to design, implement, optimize, and manage enterprise Data Loss Prevention solutions across Microsoft 365, on-premises infrastructure, cloud environments, and endpoint systems.

The ideal candidate will have strong hands-on experience with Microsoft Purview DLP, Microsoft Sentinel, Microsoft Defender for Endpoint, Active Directory, and Microsoft Entra ID, with the ability to integrate security monitoring, data classification, incident response, and automated enforcement mechanisms.

This role will focus on preventing unauthorized access, excessive file transfers, sensitive data exposure, and data exfiltration across enterprise environments.

Key Responsibilities1. DLP Architecture and Engineering

• Design, deploy, and maintain enterprise DLP solutions using Microsoft Purview.
• Develop and implement DLP policies for Microsoft 365, SharePoint, OneDrive, Exchange Online, Teams, endpoints, and supported on-premises data sources.
• Configure sensitive information types, sensitivity labels, data classification policies, and content inspection rules.
• Establish DLP controls to detect and prevent unauthorized file copying, downloading, uploading, and external sharing.
• Develop DLP enforcement strategies across SMB file shares, cloud repositories, and enterprise document management systems.

2. Microsoft Sentinel and Security Automation

• Integrate Microsoft Purview DLP alerts and audit events with Microsoft Sentinel for centralized monitoring and incident response.
• Develop KQL queries, analytics rules, and correlation logic to identify suspicious file access and potential data exfiltration.
• Implement file activity monitoring based on user behavior, file sensitivity, transfer volume, frequency, and configurable thresholds.
• Develop automated security response workflows using Microsoft Sentinel playbooks, Azure Logic Apps, PowerShell, and Microsoft Graph APIs.
• Integrate DLP events with SOAR platforms to automate incident enrichment, escalation, containment, and remediation.

3. File Share Monitoring and Access Enforcement

• Design monitoring solutions for Windows file servers, SMB shares, and other enterprise file repositories.
• Configure and optimize Windows file access auditing, including relevant security event collection and forwarding.
• Develop detection logic to identify abnormal file access, bulk file downloads, excessive copying, and suspicious user activity.
• Integrate file server telemetry into Microsoft Sentinel and supporting security monitoring platforms.
• Implement automated response mechanisms to restrict access through Active Directory group membership, file share permissions, or account controls, subject to approved security policies.
• Evaluate additional file activity monitoring and data security platforms where native Microsoft capabilities do not provide sufficient visibility or enforcement.

4. Security Policy and Data Protection

• Collaborate with Security Operations, Identity and Access Management, Infrastructure, and Compliance teams to define enterprise data protection standards.
• Develop risk-based policies to protect sensitive, confidential, and regulated information.
• Align DLP controls with applicable regulatory and security frameworks, including NIST, ISO 27001, HIPAA, PCI DSS, and organizational compliance requirements.
• Establish exception management, policy tuning, and false-positive reduction processes.
• Support data governance, information protection, insider risk management, and Zero Trust security initiatives.

5. Operations, Troubleshooting, and Continuous Improvement

• Troubleshoot DLP policy enforcement, telemetry collection, connector integration, and security automation workflows.
• Investigate DLP incidents involving unauthorized data movement and potential insider threats.
• Develop security dashboards, reporting, and key performance indicators for DLP effectiveness.
• Conduct testing and validation of detection thresholds, automated enforcement, and incident response workflows.
• Maintain technical documentation, operational runbooks, and architecture diagrams.

Required Qualifications

• 5+ years of experience in cybersecurity engineering, information security, or enterprise security operations.
• 3+ years of hands-on experience implementing and supporting DLP technologies.
• Strong knowledge of Microsoft Purview DLP, Microsoft Sentinel, Microsoft Defender, Active Directory, and Microsoft Entra ID.
• Experience with Microsoft 365 security, compliance, and information protection capabilities.
• Experience collecting and analyzing Windows Server security logs and SMB file access activity.
• Proficiency in Kusto Query Language (KQL), PowerShell, and security automation.
• Experience integrating security platforms using REST APIs, webhooks, and event-driven workflows.
• Strong understanding of file systems, NTFS permissions, SMB protocols, Windows security auditing, and identity-based access controls.
• Familiarity with SIEM/SOAR architecture, security incident response, and enterprise security monitoring.
• Ability to translate business requirements into technically enforceable data protection controls.

Preferred Qualifications

• Experience with Microsoft Defender for Cloud Apps, Microsoft Purview Insider Risk Management, and adaptive protection.
• Familiarity with Microsoft Graph APIs, Azure Logic Apps, Azure Functions, and automation platforms such as Tines.
• Experience integrating DLP solutions with ServiceNow, SysAid, or other ITSM platforms.
• Knowledge of additional DLP platforms such as Broadcom Symantec DLP, Forcepoint DLP, or Netskope.
• Experience with Microsoft Defender for Identity and identity-based threat detection.
• Understanding of UEBA, anomaly detection, and insider threat monitoring.
• Experience with hybrid infrastructure spanning on-premises Active Directory and Microsoft Azure.

Preferred Certifications:

• Microsoft Certified: Information Security Administrator Associate (SC-401)
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• CISSP, CISM, or equivalent security certifications

Key Deliverables and Success Metrics

• Enterprise DLP policies deployed and operational across prioritized data repositories.
• Centralized visibility into sensitive data access and unauthorized transfer activity.
• Effective detection of abnormal file movement and bulk file access.
• Automated incident response and access restriction workflows with appropriate approval and safeguards.
• Reduced DLP false positives and improved detection accuracy.
• Documented security architecture, operational runbooks, and monitoring dashboards.

Ideal Candidate

The successful candidate is a hands-on security engineer capable of working across multiple security domains, including DLP, SIEM, SOAR, identity management, file systems, and cloud security.

This individual must understand not only how to configure DLP policies but also how to engineer end-to-end solutions that correlate file activity with user identity, detect suspicious behavior, and initiate controlled security responses across enterprise infrastructure.

Pay: $65.00 - $85.00 per hour

Expected hours: 10.0 – 25.0 per week

Work Location: Remote

Plata: $65 - $85 an hour

Rad na daljinu: Da

Izvor: https://indeed.com/viewjob?jk=acae85e9307d4377

Nivo: mid level