IT Security Engineer - DLP and CASB Engineering - Remote

IT Security Engineer - DLP and CASB Engineering - Remote Location: Remote (eligible for U.S. applicants except Hawaii and Alaska). Responsibilities Design, implement, and optimize enterprise-wide DLP controls using Microsoft Purview DLP, Information Protection, and Netskope DLP/CASB. Engineer DLP policies, classifiers, exceptions, and workflows for cloud (SaaS, IaaS, PaaS), endpoint, and web channels. Lead integration of DLP and CASB tools with cloud platforms including AWS, Azure, and Google Cloud. Partner with cloud architects and application teams to embed DLP and CASB controls into cloud‑native environments and support secure data flows across S3, Blob, Snowflake, SQL, and SaaS applications. Develop and enforce advanced DLP policies aligned to security standards, regulatory requirements, and risk tolerance. Minimize false positives through tuning, classifier creation, and rule optimization. Work closely with SOC and SIEM teams (Splunk preferred) to ensure high‑fidelity telemetry and alerting. Build dashboards, analytics, and automation opportunities that improve detection and reduce manual effort. Serve as a technical expert for complex DLP and CASB incidents; perform root‑cause engineering, propose long‑term fixes, and partner with SOC on response playbooks. Provide leadership in mapping DLP controls to GDPR, CCPA, PCI, HIPAA, and other frameworks. Deliver executive‑level reporting and insights to leadership on DLP posture, risks, and improvements. Develop standards for data classification, masking, retention, archival, and secure data flows. Maintain technical documentation, SOPs, and lead stakeholder education workshops. Assess new DLP, CASB, and cloud security capabilities; lead POCs and vendor evaluations. Drive modernization efforts, platform migrations, and optimization initiatives. Analyze DLP and CASB events across Microsoft Purview, Netskope, MDCA, and related tools. Identify patterns, trends, mis‑configurations, and gaps to recommend or implement tuning and policy improvements. Collaborate with SOC, Cyber Defense, and Security Engineering to align priorities, establish best‑practice playbooks, and improve DLP/incident response workflows. Work with IT, Cloud, and Business partners to design scalable, efficient, and compliant processes for protecting internal and external data flows. Educate and influence stakeholders on DLP findings, risk areas, and recommended mitigations. Apply a risk‑based approach to analyze, prioritize, and remediate data protection risks across the enterprise and ensure alignment with regulatory requirements and corporate security standards. Qualifications 7–10+ years in DLP engineering, cybersecurity, or cloud security roles. Strong hands‑on experience with Microsoft Purview, AIP, labels, classifiers, DLP/Information Protection, Netskope DLP/CASB, and cloud security controls. Proven experience engineering DLP policies, integrating with cloud apps, and supporting enterprise‑scale environments. Deep understanding of MDCA/Defender for Cloud Apps, AWS, Azure, GCP data‑protection patterns, SIEM (Splunk), log pipelines, and dashboards. Strong troubleshooting and root‑cause analysis skills. Excellent communication, documentation, and cross‑functional collaboration abilities. Ability to translate technical DLP concepts for non‑technical partners. Demonstrated leadership in driving security best practices across teams. Preferred Qualifications CCSP, CISSP, CISM, Azure Security Engineer, AWS Security Specialty, Netskope, or Microsoft certifications. Vendor certifications (Microsoft Security, Netskope, etc.). Experience shaping company culture through employee resource groups, volunteer activities, or related initiatives. Other Requirements Must be authorized to work in the United States indefinitely. The role does not provide visa sponsorship. Ability to travel as needed for team meetings and in‑person engagements. EEO Statement CSAA Insurance Group is an equal‑opportunity employer. CSAA is committed to providing reasonable accommodations to qualified applicants and employees with disabilities or other limitations. #J-18808-Ljbffr