Note: The job is a remote job and is open to candidates in USA. Fragomen is an AmLaw 100 Firm and the leading global immigration services provider. The company is seeking a Senior Security Engineer focused on Data Loss Prevention to design, implement, tune, and operate DLP controls across email, endpoint, cloud, SaaS, and collaboration platforms. The role also partners with legal, compliance, privacy, risk, IT, and business teams to strengthen enterprise data protection capabilities.
Responsibilities
- Design, implement, and tune enterprise DLP policies across Microsoft 365, endpoint, email, SaaS, cloud, and collaboration platforms
- Identify, classify, and protect sensitive information using data classification, sensitivity labels, policy conditions, and appropriate enforcement actions
- Monitor and investigate DLP alerts involving potential data exposure, improper sharing, data exfiltration indicators, or policy violations
- Partner with Legal, Compliance, Privacy, Risk, Records, and business stakeholders to align DLP controls with regulatory, legal, client, and operational requirements
- Develop and maintain DLP standards, operating procedures, runbooks, exception processes, and escalation workflows
- Evaluate and improve controls for collaboration platforms and file-sharing tools, including OneDrive, SharePoint, Box, Google Drive, Dropbox, ShareFile, NetDocuments, and similar services
- Support CASB and SaaS governance efforts by helping identify unsanctioned data movement, risky sharing behavior, excessive permissions, and opportunities for policy enforcement
- Conduct root cause analysis on recurring alerts, control gaps, and data handling issues to improve policy quality and reduce false positives
- Collaborate with security operations, identity, messaging, endpoint, network, and application teams to integrate DLP telemetry into SIEM, SOAR, monitoring, and response processes
- Prepare clear, business-appropriate communications for end users, technical teams, stakeholders, and leadership regarding DLP findings, policy changes, and recommended corrective actions
- Provide technical guidance and mentorship to junior analysts and security team members on DLP investigations, data handling risk, and control operations
Skills
- * 5+ years of experience in cybersecurity, data protection, security operations, governance, risk, compliance, or related technology roles, or equivalent combination of education and experience
- * Working knowledge of DLP concepts, sensitive data handling, information protection, data classification, and policy-based enforcement
- * Hands-on experience supporting or operating security controls in enterprise environments, especially within Microsoft 365, email, endpoint, cloud, or SaaS platforms
- * Ability to analyze DLP alerts, user activity, sharing patterns, policy matches, and event logs to determine business impact and appropriate response
- * Working knowledge of identity and access concepts, authentication mechanisms, file permissions, collaboration tooling, and data sharing workflows
- * Strong written and verbal communication skills, including the ability to explain technical findings in clear, practical, and business-appropriate language
- * Demonstrated ability to follow structured processes while continuously improving them
- * Microsoft Purview Information Protection and DLP, including sensitivity labels, trainable classifiers, data loss prevention rules, audit logs, alerts, and policy tuning
- * Microsoft Defender for Cloud Apps, cloud app governance, CASB concepts, SaaS discovery, session controls, and cloud data exposure monitoring
- * Endpoint, email, and collaboration security controls across Windows, Microsoft 365, Exchange Online, Teams, SharePoint, and OneDrive
- * SIEM and security platforms such as Splunk, Microsoft Sentinel, QRadar, ArcSight, ELK, or similar tools used to correlate DLP and security telemetry
- * Common sensitive data types and regulatory drivers, such as PII, PCI, PHI, financial data, client confidential information, legal matter data, and regulated business records
- * Core networking and platform concepts including TCP/IP, DNS, HTTP/S, VPNs, proxies, firewalls, APIs, and cloud storage patterns
- * Experience engineering or administering Microsoft Purview DLP, Endpoint DLP, Information Protection, Insider Risk Management, eDiscovery, Audit, or Data Lifecycle Management
- * Experience with CASB, SaaS security, cloud access governance, or file-sharing risk management across platforms such as Box, Google Drive, Dropbox, ShareFile, NetDocuments, Salesforce, ServiceNow, or similar applications
- * Experience supporting investigations involving Legal, Compliance, Privacy, Risk, Records, HR, or regulatory stakeholders
- * Experience with SOAR, ticketing, workflow automation, and process documentation for recurring security operations activities
- * Knowledge of secure collaboration practices, permission review, data retention, acceptable use, and exception governance
- * Relevant certifications, including Microsoft Security, Compliance, and Identity certifications; CISSP, SSCP, Security+, CISA, CISM; GIAC security certifications; or vendor certifications for DLP, CASB, SIEM, or endpoint platforms
Company Overview