DLP Engineer

First Horizon Bank; Memphis (TN); On-site; USD 90,000 - 120,000; Full time

Job summary

First Horizon Bank is seeking a hands-on Data Security & Insider Risk Analyst to protect sensitive information across Microsoft 365, endpoints, and other platforms. You will investigate DLP, insider risk, and endpoint events while tuning Purview policies and workflows to reduce risk.

The ideal candidate is analytical, curious, and can translate security data into actionable controls, with strong communication for confidential investigations and cross-team collaboration.

Qualifications

• Experience in information security, data protection, security operations, incident response, or related discipline.
• Knowledge of DLP concepts, data classification, insider risk, and exfiltration paths.
• Ability to investigate alerts using evidence from users, devices, apps, email, logs.
• Experience configuring/tuning security policies, detections, or alerting logic in an enterprise.
• Strong analytical and problem-solving skills and clear written/verbal communication.
• Ability to manage multiple investigations with accurate case documentation.

Responsibilities

• Monitor, triage, investigate, and respond to DLP, insider risk, and endpoint alerts/incidents.
• Document findings with business context and coordinate containment/remediation.
• Tune Purview DLP policies, rules, information types, classifiers, thresholds, and notifications.
• Support DLP controls across Exchange, SharePoint, OneDrive, Teams, endpoints, and cloud apps.
• Review false positives/negatives and implement policy improvements.
• Support Purview Insider Risk Management policies, alerts, and investigations.
• Collaborate with identity, security, HR, IR teams during investigations and control changes.
• Leverage Purview, Defender, SIEM/SOAR, and telemetry to build timelines and validate findings.
• Create dashboards and trend analyses showing incident volume, policy effectiveness, and gaps.
• Develop and maintain procedures, playbooks, tuning standards, and knowledge articles.
• Participate in testing, change management, and phased deployment of data protections.
• Identify opportunities for automation and workflow integration to improve response speed.

Skills

DLP concepts

Insider risk

Security policy tuning

Threat analysis

Incident response

Analytical thinking

Communication skills

Case management

Tools

Microsoft Purview

Microsoft Defender

SentinelOne

Splunk SIEM

Power BI

Tableau

SQL

Excel

Kusto (KQL)

Job description

Job Description

Data Security & Insider Risk Analyst

Suggested alternate title: Data Security Analyst – DLP & Insider Risk

Position Summary

We are seeking a hands-on Data Security & Insider Risk Analyst to protect sensitive information across Microsoft 365, endpoints, and other enterprise platforms. This role combines security operations with platform engineering: the analyst will investigate and respond to data loss prevention (DLP), insider risk, and endpoint security events while continuously tuning Microsoft Purview policies, detections, and workflows to improve accuracy and reduce risk. The ideal candidate is analytical, curious, and comfortable translating security data into clear findings and practical control improvements.

Key Responsibilities

• Monitor, triage, investigate, and respond to DLP, insider risk, and endpoint security alerts and incidents.
• Determine incident scope, business context, data sensitivity, user activity, and potential impact; document findings and coordinate appropriate containment, escalation, and remediation.
• Administer and tune Microsoft Purview DLP policies, rules, sensitive information types, classifiers, alert thresholds, exceptions, and user notifications.
• Support DLP controls across Exchange, SharePoint, OneDrive, Teams, endpoints, browsers, removable media, printing, clipboard activity, and cloud applications, as applicable.
• Review false positives, false negatives, user overrides, and recurring alert patterns; recommend and implement policy improvements.
• Support Microsoft Purview Insider Risk Management use cases, indicators, policies, alerts, cases, and privacy-aware investigation workflows.
• Partner with identity, corporate security, human resources, incident response teams, and line-of-business teams during investigations, containment, remediation, and control changes.
• Use Microsoft Purview, Microsoft Defender, SentinelOne EDR, Splunk SIEM, audit, identity, and endpoint telemetry to build investigation timelines, correlate activity, and validate findings.
• Create dashboards, metrics, and trend analyses that communicate incident volume, policy effectiveness, data movement, root causes, and control gaps.
• Develop and maintain procedures, investigation playbooks, tuning standards, exception records, and knowledge articles.
• Participate in testing, change management, and phased deployment of new or updated data protection controls.
• Identify opportunities for automation, enrichment, and workflow integration that improve response speed and consistency.

Required Qualifications

• Experience in information security, data protection, security operations, incident response, threat analysis, compliance operations, criminology, law enforcement, corporate security, fraud investigation, or a related discipline. Candidates with transferable investigative experience are encouraged to apply.
• Working knowledge of DLP concepts, data classification, sensitive data handling, insider risk, and common data exfiltration paths.
• Ability to investigate alerts using evidence from users, devices, applications, email, collaboration platforms, and audit logs.
• Experience configuring or tuning security policies, detections, rules, or alerting logic in an enterprise environment.
• Strong analytical and problem-solving skills, including the ability to distinguish legitimate business activity from potential misuse.
• Clear written and verbal communication skills, with the judgment to handle sensitive investigations professionally and confidentially.
• Ability to manage multiple investigations and tuning efforts while maintaining accurate case documentation.

Preferred Qualifications

• Hands-on experience with Microsoft Purview Data Loss Prevention, Endpoint DLP, Insider Risk Management, Information Protection, Data Explorer, Activity Explorer, or related capabilities.
• Hands-on experience with Zscaler Data Loss Prevention (DLP), including policy configuration, content inspection, alert investigation, false-positive tuning, or data exfiltration controls across web, cloud applications and email.
• Experience investigating Microsoft Purview alerts and incidents through Microsoft Defender or an integrated SIEM/SOAR workflow.
• Experience using any endpoint detection and response (EDR) platform to investigate endpoint activity, correlate alerts, or support containment and remediation. Experience with comparable EDR tools is readily transferable to SentinelOne, which is used in this role.
• Data analytics or reporting experience using Power BI, Tableau, SQL, Kusto Query Language (KQL), Excel, or similar tools.
• Experience using any security information and event management (SIEM) platform for searching, correlation, dashboards, reporting, or investigation support. Experience with comparable SIEM tools is readily transferable to Splunk, which is used in this role.
• Understanding of Microsoft 365 services, Microsoft Entra ID, endpoint management, audit logging, and cloud security concepts.
• Experience in a regulated industry or with privacy, records management, legal, HR, or compliance stakeholders.
• Relevant certifications, such as Microsoft Information Protection and Compliance Administrator (SC-400), Microsoft Security Operations Analyst (SC-200), Security+, or equivalent practical experience.
• Professional experience in criminology, law enforcement, corporate security, fraud, investigations, or a similar field that demonstrates sound investigative judgment, evidence handling, interviewing, case management, or pattern analysis.

What Success Looks Like

• DLP and insider risk alerts are investigated promptly, consistently, and with clear supporting evidence.
• Policies become more effective over time, with fewer unnecessary alerts and better coverage of meaningful risk.
• Incident trends and control gaps are translated into measurable recommendations for security and business partners.
• Investigation procedures, tuning decisions, and exceptions are documented and repeatable.
• Data security, endpoint security, and business stakeholders collaborate effectively on remediation and risk reduction.

Ideal Candidate Profile

You enjoy both sides of data security operations: working an alert through investigation and resolution, then using what you learned to improve the control that generated it. You can analyze technical evidence, understand business context, communicate findings without unnecessary jargon, and make thoughtful tuning decisions that balance protection with user productivity.