DLP Engineer

First-Horizon-Bank; Memphis (TN); On-site; USD 90,000 - 120,000; Full time

Job summary

First Horizon Bank in Memphis seeks a hands-on Data Security & Insider Risk Analyst to protect sensitive information across Microsoft 365, endpoints, and enterprise platforms. You will investigate DLP, insider risk, and endpoint security events while tuning Microsoft Purview policies to improve accuracy and reduce risk.

Collaborating with security, IT, HR, and compliance teams, you will develop dashboards, document procedures, and drive practical control improvements.

Qualifications

• Experience in information security, data protection, security operations, incident response, or a related discipline.
• Working knowledge of DLP concepts, data classification, sensitive data handling, insider risk, and exfiltration paths.
• Ability to investigate alerts using evidence from users, devices, applications, email, collaboration platforms, and logs.
• Experience configuring or tuning security policies, detections, or alerting logic in an enterprise environment.
• Strong analytical and problem-solving skills with clear judgment.
• Clear written and verbal communication, handling sensitive investigations professionally.
• Ability to manage multiple investigations with thorough case documentation.

Responsibilities

• Monitor, triage, investigate, and respond to DLP, insider risk, and endpoint security alerts.
• Determine incident scope, data sensitivity, and potential impact; document findings and containment steps.
• Administer and tune Purview DLP policies, rules, classifiers, and notifications.
• Support DLP controls across Exchange, SharePoint, OneDrive, Teams, endpoints, and cloud apps.
• Review false positives/negatives and implement policy improvements.
• Support Insider Risk Management use cases, policies, and privacy-aware workflows.
• Collaborate with identity, security, HR, IR teams during investigations and remediations.
• Utilize Purview, Defender, SIEMs to build timelines and validate findings.
• Create dashboards and metrics communicating incident trends and control gaps.
• Develop procedures, playbooks, tuning standards, and knowledge articles.

Skills

Security operations

Incident response

Data protection

DLP concepts

Insider risk

Investigation skills

Analytical thinking

Communication skills

Tools

Microsoft Purview

Microsoft Defender

SentinelOne EDR

Splunk SIEM

Power BI

Tableau

SQL

Excel

Kusto (KQL)

Job description

Data Security & Insider Risk Analyst

Suggested alternate title: Data Security Analyst – DLP & Insider Risk

Position Summary

We are seeking a hands‑on Data Security & Insider Risk Analyst to protect sensitive information across Microsoft 365, endpoints, and other enterprise platforms. This role combines security operations with platform engineering: the analyst will investigate and respond to data loss prevention (DLP), insider risk, and endpoint security events while continuously tuning Microsoft Purview policies, detections, and workflows to improve accuracy and reduce risk. The ideal candidate is analytical, curious, and comfortable translating security data into clear findings and practical control improvements.

Key Responsibilities

• Monitor, triage, investigate, and respond to DLP, insider risk, and endpoint security alerts and incidents.
• Determine incident scope, business context, data sensitivity, user activity, and potential impact; document findings and coordinate appropriate containment, escalation, and remediation.
• Administer and tune Microsoft Purview DLP policies, rules, sensitive information types, classifiers, alert thresholds, exceptions, and user notifications.
• Support DLP controls across Exchange, SharePoint, OneDrive, Teams, endpoints, browsers, removable media, printing, clipboard activity, and cloud applications, as applicable.
• Review false positives, false negatives, user overrides, and recurring alert patterns; recommend and implement policy improvements.
• Support Microsoft Purview Insider Risk Management use cases, indicators, policies, alerts, cases, and privacy‑aware investigation workflows.
• Partner with identity, corporate security, human resources, incident response teams, and line‑of‑business teams during investigations, containment, remediation, and control changes.
• Use Microsoft Purview, Microsoft Defender, SentinelOne EDR, Splunk SIEM, audit, identity, and endpoint telemetry to build investigation timelines, correlate activity, and validate findings.
• Create dashboards, metrics, and trend analyses that communicate incident volume, policy effectiveness, data movement, root causes, and control gaps.
• Develop and maintain procedures, investigation playbooks, tuning standards, exception records, and knowledge articles.
• Participate in testing, change management, and phased deployment of new or updated data protection controls.
• Identify opportunities for automation, enrichment, and workflow integration that improve response speed and consistency.

Required Qualifications

• Experience in information security, data protection, security operations, incident response, threat analysis, compliance operations, criminology, law enforcement, corporate security, fraud investigation, or a related discipline. Candidates with transferable investigative experience are encouraged to apply.
• Working knowledge of DLP concepts, data classification, sensitive data handling, insider risk, and common data exfiltration paths.
• Ability to investigate alerts using evidence from users, devices, applications, email, collaboration platforms, and audit logs.
• Experience configuring or tuning security policies, detections, rules, or alerting logic in an enterprise environment.
• Strong analytical and problem‑solving skills, including the ability to distinguish legitimate business activity from potential misuse.
• Clear written and verbal communication skills, with the judgment to handle sensitive investigations professionally and confidentially.
• Ability to manage multiple investigations and tuning efforts while maintaining accurate case documentation.

Preferred Qualifications

• Hands‑on experience with Microsoft Purview Data Loss Prevention, Endpoint DLP, Insider Risk Management, Information Protection, Data Explorer, Activity Explorer, or related capabilities.
• Hands‑on experience with Zscaler Data Loss Prevention (DLP), including policy configuration, content inspection, alert investigation, false‑positive tuning, or data exfiltration controls across web, cloud applications and email.
• Experience investigating Microsoft Purview alerts and incidents through Microsoft Defender or an integrated SIEM/SOAR workflow.
• Experience using any endpoint detection and response (EDR) platform to investigate endpoint activity, correlate alerts, or support containment and remediation. Experience with comparable EDR tools is readily transferable to SentinelOne, which is used in this role.
• Data analytics or reporting experience using Power BI, Tableau, SQL, Kusto Query Language (KQL), Excel, or similar tools.
• Experience using any security information and event management (SIEM) platform for searching, correlation, dashboards, reporting, or investigation support. Experience with comparable SIEM tools is readily transferable to Splunk, which is used in this role.
• Understanding of Microsoft 365 services, Microsoft Entra ID, endpoint management, audit logging, and cloud security concepts.
• Experience in a regulated industry or with privacy, records management, legal, HR, or compliance stakeholders.
• Relevant certifications, such as Microsoft Information Protection and Compliance Administrator (SC‑400), Microsoft Security Operations Analyst (SC‑200), Security+, or equivalent practical experience.
• Professional experience in criminology, law enforcement, corporate security, fraud, investigations, or a similar field that demonstrates sound investigative judgment, evidence handling, interviewing, case management, or pattern analysis.

What Success Looks Like

• DLP and insider risk alerts are investigated promptly, consistently, and with clear supporting evidence.
• Policies become more effective over time, with fewer unnecessary alerts and better coverage of meaningful risk.
• Incident trends and control gaps are translated into measurable recommendations for security and business partners.
• Investigation procedures, tuning decisions, and exceptions are documented and repeatable.
• Data security, endpoint security, and business stakeholders collaborate effectively on remediation and risk reduction.

Ideal Candidate Profile

You enjoy both sides of data security operations: working an alert through investigation and resolution, then using what you learned to improve the control that generated it. You can analyze technical evidence, understand business context, communicate findings without unnecessary jargon, and make thoughtful tuning decisions that balance protection with user productivity.