Tech Risk - Associate - DLP Engineering - Dallas

About the Role

A Data Loss Prevention (DLP) Engineer plays a pivotal role in protecting the firm's most sensitive data. This position involves managing the end-to-end lifecycle of the DLP program, from developing and tuning detection rules to analyzing complex DLP events. The role requires a strong automation mindset to leverage SOAR capabilities and ServiceNow for automating workflows, streamlining case management, and enhancing review activities across the modern security stack (Microsoft Purview, Defender, Zscaler, Proofpoint) as well as internally developed systems.

Responsibilities

• Design, implement, and continuously tune DLP detection capabilities and policies across Microsoft Purview, Zscaler, and Proofpoint to maximize true positives and minimize operational friction.
• Develop custom detection logic and integrations for internally developed systems.
• Perform regular testing and validation of existing DLP controls to identify coverage gaps and bypass techniques.
• Engineer automation workflows to assist DLP analysts, reducing manual review time and automating the triage of low-fidelity events.
• Collaborate directly with data owners, legal, and compliance teams to translate business and regulatory requirements into technical enforcement rules.
• Evaluate and integrate additional DLP tools, and participate in proof-of-concept trials.

Required Technical Skills

• DLP & Security Operations: Proven experience handling data loss incidents, insider threat investigations, or general security incident response. Ability to recognize what constitutes a high-quality alert.
• Core Stack Expertise: Deep, hands-on administrative experience with tools like Microsoft Purview, Zscaler, ServiceNow, and Proofpoint.
• Automation & Scripting: Strong proficiency in tools like Python or PowerShell, with the ability to interact with REST APIs to pull logs, enrich alerts, and trigger automated response actions.
• Detection Engineering: Proficiency with regular expressions, exact data matching, indexed document matching, and custom dictionary creation.
• System Architecture: Solid understanding of enterprise network routing, proxies, cloud access, and mail transport rules.

What Sets You Apart

• Experience integrating DLP tooling with SOAR platforms (e.g., Splunk SOAR, Cortex XSOAR, Tines) to build end-to-end automated review pipelines.
• Background in software engineering or DevSecOps, with an understanding of CI/CD pipelines and version control for managing detection as code.
• A “builder” mindset: preference for solving problems with code rather than relying solely on out-of-the-box vendor configurations.
• Applied AI/ML in Detection Engineering: experience moving beyond static rules by training, tuning, and deploying ML classifiers for context-aware data discovery. Familiarity with Microsoft Purview’s Trainable Classifiers or using custom Natural Language Processing models to identify sensitive data types that traditional regex approaches miss.
• Agentic workflow automation: experience building next-generation, LLM-driven “agentic” workflows. Ability to move beyond basic SOAR playbooks and build autonomous systems where AI agents gather contextual telemetry, interact directly with employees (e.g., via MS Teams bots, email, task management systems) to verify business intent, and pre-triage alerts before manual review.