Lead DLP Engineer - Remote / Telecommute

Job Title

Job Overview

Responsibilities:

Act as L3 escalation and SME for complex DLP incidents.

Design and implement enterprise DLP architecture across endpoint, email, network, and cloud.

Lead USB / removable media control (blocking, encryption, whitelisting).

Develop and tune DLP policies, classifiers, and SITs to reduce false positives.

Manage Microsoft Purview agents, policies, upgrades, troubleshooting.

Integrate DLP with SIEM / SOAR / ITSM platforms.

Perform forensic analysis and root cause investigations.

Advise stakeholders on GDPR, HIPAA, PCI‑DSS, ISO 27001 requirements.

Mentor L1/L2 engineers and maintain SOPs/runbooks.

Skills and Technologies:

Microsoft Purview DLP (Endpoint, Exchange, SharePoint, OneDrive, Teams).

Trellix DLP Suite (ePO, Endpoint DLP, Network DLP, Discover, Device Control).

USB / Device Control & Encryption Enforcement.

Data classification, regex, keyword dictionaries, EDM.

SIEM integration (Sentinel / Splunk).

PowerShell, KQL (basic automation & investigation).

Insider Risk Management.

CASB (Defender for Cloud Apps).

CISSP / CISM.

Expert: Microsoft Purview, Incident Forensics, SIEM Integration.

Advanced: DLP Architecture, Trellix, USB Control.

Advanced: Automation & Reporting.