Senior Security Operations Engineer

Team: Cyber Security

Location: Remote

Commitment: Full-Time

Workplace Type: remote

Responsibilities:

• Lead the response to DLP and data security incidents, including investigation, containment, remediation, and root cause analysis for suspected data exfiltration or improper data handling.

• Own the deployment, configuration, and continuous tuning of DLP controls across endpoints, network egress, SaaS applications, and cloud storage to protect PHI, PII, PCI, and other sensitive data.

• Develop and maintain DLP policies, rules, and classifications that balance security, usability, and regulatory/client requirements.

• Build and refine automated response playbooks and workflows that enrich, triage, and respond to alerts, reducing manual effort and mean time to respond.

• Perform proactive hunting for anomalous data movement, including unusual destinations, channels, or volumes.

• Define and track key DLP metrics (coverage, detection quality, MTTD/MTTR, false positive rate) and communicate progress to security leadership and cross-functional partners.

Qualifications:

• Minimum 5+ years of hands-on experience in security operations, incident response, or security engineering roles, with a strong emphasis on data protection and DLP.

• Direct, hands-on experience deploying, tuning, and operating

  • DLP tools (endpoint, network, SaaS, and/or cloud)

  • Cloud Access Security Broker (CASB) or similar SaaS security controls in a production environment.

  • DLP signals into SIEM/SOAR workflows (e.g., CrowdStrike, Splunk, Sentinel)

  • Advanced scripting/automation skills (e.g., Python, PowerShell, KQL/SQL) used to enrich, tune, and report on DLP/IR telemetry at scale.

  • Experience designing and maintaining data classification and policy frameworks for PHI, PII, PCI, and other sensitive data types.