Cloud Data Loss Prevention (DLP) Architect

Cloud Data Loss Prevention (DLP) Architect

Location: Malvern, PA (Philly area) OR Plano, TX (Dallas area). Duration: 9-12+ month contract (Possibility of extension)

Key Responsibilities

• Architect and own the end-to-end Cloud DLP and DSPM capability, covering data-at-rest, data-in-motion, and data-in-use.
• Design scalable architectures for continuous sensitive data discovery and classification across SaaS, cloud storage, and data platforms.
• Integrate DSPM findings into Cloud DLP policy strategy, enabling risk-based enforcement and prioritization.

Data Risk Management

• Identify and reduce cloud data risk, including shadow data, over-exposed data, excessive permissions, and toxic data combinations.
• Establish data risk scoring and posture metrics based on sensitivity, exposure, access, and business impact.
• Drive remediation strategies in partnership with application owners and platform teams.

Policy Strategy & Enforcement

• Define Cloud DLP policies aligned to data classification, regulatory obligations, and business risk tolerance.
• Lead the transition from monitor to enforce models while minimizing business disruption.
• Ensure consistent policy alignment across Cloud, Network, and Endpoint DLP domains.

Security Operations & Incident Response

• Integrate Cloud DLP and DSPM telemetry into SOC and IR workflows.
• Support investigation and response to cloud data exposure and exfiltration events.
• Reduce false positives through tuning, automation, and advanced detection techniques.

Cross-Functional Leadership

• Serve as the cloud data protection subject-matter expert for architecture reviews and strategic initiatives.
• Partner with Cloud Engineering, IAM, Legal, Privacy, Compliance, and Risk teams to ensure aligned outcomes.
• Provide technical guidance and mentorship to DLP engineers and analysts.

Reporting & Executive Engagement

• Deliver clear, risk-based reporting to senior leadership and regulators.
• Translate technical findings into business-relevant insights and decisions.
• Support audits (SOC2, GDPR, GLBA, etc.) with defensible evidence and documentation.

Required Qualifications

Experience

• 7+ years in information security, with strong focus on cloud and data security.
• 3+ years architecting or leading Cloud DLP and/or DSPM solutions.
• Proven experience protecting data across SaaS, IaaS, and PaaS environments.

Technical Expertise

• Cloud DLP platforms (e.g., Microsoft Purview, Palo Alto Enterprise DLP, Zscaler DLP).
• DSPM technologies and methodologies (data discovery, classification, exposure analysis).
• Cloud platforms: Microsoft Azure, AWS, and/or GCP.
• SaaS data protection (Microsoft 365, cloud storage, enterprise SaaS).
• Integration with IAM, CASB, SSPM, SIEM, and SOAR.

Security & Risk Knowledge

• Data classification frameworks and information protection standards.
• Regulatory requirements impacting data protection (e.g., GDPR, GLBA, SOC2).
• Zero Trust and SASE architectures as they relate to data security.