Data Security Engineer — DLP & Data Protection Lead

Point72 Careers; New York (NY); On-site; USD 180,000 - 250,000; Full time

Benefits offered by this job

Health benefits

Parental leave

Volunteer opportunities

Affinity groups

Wellness programs

Tuition assistance

401(k) plan

Job summary

Point72 is seeking a Data Security Engineer to shape how the firm identifies, protects, and governs sensitive data across workplace and cloud environments. You will own the control estate within Infrastructure Security, reporting to the Head of Infrastructure Security, and design and operate DLP controls across endpoints, email, and storage.

Key duties include building taxonomy, extending coverage to databases and cloud storage, and automating policy deployment via scripting and APIs.

Qualifications

• 5+ years in security engineering, including 3+ years focused on data protection or data loss prevention.
• Hands-on experience deploying and operating data protection platforms, such as Microsoft Purview, including sensitivity labels, auto-labeling, policies, sensitive information types, trainable classifiers, and endpoint controls.
• Hands-on experience administering a data protection platform covering permissions analysis, classification, alerting, and automated remediation across on-premises and cloud data stores.
• Experience enforcing data loss prevention through secure web gateways and cloud access security brokers, such as Zscaler, Palo Alto Networks, or Netskope.
• Experience securing cloud collaboration and storage platforms, such as Box, SharePoint Online, and OneDrive, with native access policies and external sharing controls.
• Working knowledge of productivity suite administration, such as Microsoft 365, across Exchange Online, SharePoint Online, OneDrive, and Teams.
• Scripting ability in PowerShell or Python, including experience with platform and vendor APIs, such as Microsoft Graph.
• Experience securing structured data through database activity monitoring, database classification, or SaaS data protection.
• Understanding of data classification frameworks and regulatory requirements relevant to financial services, with experience delivering sprint backlog items through verified completion and cross-team collaboration.
• Commitment to the highest ethical standards

Responsibilities

• Design and operate enterprise data loss prevention controls across endpoints, email, collaboration platforms, and cloud storage
• Deploy data protection policies across email, file storage, collaboration platforms, and endpoint devices
• Build and maintain the classification taxonomy, sensitivity labels, auto-labeling rules, sensitive information types, and trainable classifiers that improve policy matching
• Administer data access governance controls that identify overexposed, stale, and sensitive data and support least-privilege remediation
• Extend classification and protection coverage to databases, SaaS applications, and cloud object storage
• Integrate egress enforcement with secure web gateway, cloud access security broker, and collaboration platform access controls
• Tune policies using telemetry to reduce false positives while preserving detection coverage across communication and storage channels
• Operate incident workflows for alert triage, user notification, security escalation, and evidence retention
• Automate policy deployment, reporting, and remediation through scripting and APIs
• Maintain data protection standards, policy documentation, and change control for classification and data loss prevention changes

Skills

Data protection

Data loss prevention

Microsoft Purview

Scripting (PowerShell)

Cloud security

DLP automation

Classification taxonomy

Least privilege

Microsoft 365 security

Microsoft Graph

Tools

Zscaler

Palo Alto Networks

Netskope

Box

SharePoint Online

OneDrive

Exchange Online

APIs (Microsoft Graph)

Job description

Point72 is seeking a Data Security Engineer to shape how the firm identifies, protects, and governs sensitive data across workplace and cloud environments. You will own the control estate within Infrastructure Security, reporting to the Head of Infrastructure Security, and design and operate DLP controls across endpoints, email, and storage.

Key duties include building taxonomy, extending coverage to databases and cloud storage, and automating policy deployment via scripting and APIs.