DLP Engineer

Sapsf; United States; On-site; USD 110,000 - 170,000; Full time

Job summary

Sapsf in the United States is seeking a Senior Insider Risk Monitoring professional to support the Microsoft Purview IRM program. You will review anonymized alerts, correlate activity across Teams, SharePoint, and endpoints, and help shape DLP strategies.

The role requires a strong background in cybersecurity, data analytics, and regex/Boolean logic, with high integrity handling sensitive information and a focus on policy automation and risk visualization for leadership.

Qualifications

• Degree in Cybersecurity, Behavioral Science, Data Analytics, or Information Systems, or equivalent.
• Six years of hands-on experience in insider risk, data protection, or security monitoring.
• Strong ability to use Boolean logic and Regular Expressions (Regex) to define sensitive data types.
• Experience with Microsoft 365 Core and Purview.
• High integrity handling highly sensitive information.

Responsibilities

• Assist in reviewing anonymized alerts in the Purview Insider Risk Management console.
• Identify patterns like Data Resignation (at-risk departing employees) or Data Leaks by correlating activity across Teams, SharePoint, and Endpoint.
• Help manage Data Loss Prevention (DLP) for IRM and Data Protection.
• Optimize Auto-labeling policies to encrypt documents containing PII, PHI, or Intellectual Property.
• Create weekly "Risk Snapshots" for leadership, visualizing trends in sensitive data exfiltration attempts.

Skills

Analytical thinking

Regex

Boolean logic

Discretion

Microsoft 365

Data privacy

Education

Bachelor's degree in Cybersecurity

Tools

Microsoft Purview

Content Explorer

Activity Explorer

DLP policies

Auto-labeling

Job description

Key Responsibilities Insider Risk (IRM) Monitoring: Assist in reviewing anonymized alerts in the Microsoft Purview Insider Risk Management console - help identify patterns like "Data Resignation" (at-risk departing employees) or "Data Leaks" by correlating activity across Teams, SharePoint, and Endpoint. DLP Strategy & Policy: Help manage Data Loss Prevention (DLP) specifically for IRM and Data Protection offering Optimization of "Auto-labeling" policies that automatically encrypt documents containing PII, PHI, or Intellectual Property Alert Correlation: Use the Content Explorer to investigate what was shared and the Activity Explorer to understand how it was shared Create weekly "Risk Snapshots" for leadership, visualizing trends in sensitive data exfiltration attempts. Technical Qualifications Education: Degree in Cybersecurity, Behavioral Science, Data Analytics, or Information Systems and/or six years of hands on experience Analytical Logic: Strong ability to use Boolean logic and Regular Expressions (Regex) to define sensitive data types. Microsoft 365 Core: Comfortable navigating the M365 ecosystem (understanding how a file moves from OneDrive to an external USB or Personal Cloud). Discretion: High level of integrity; this role involves handling highly sensitive information regarding company risk and employee behavior.

Key Responsibilities

Key Responsibilities Insider Risk (IRM) Monitoring: Assist in reviewing anonymized alerts in the Microsoft Purview Insider Risk Management console - help identify patterns like "Data Resignation" (at-risk departing employees) or "Data Leaks" by correlating activity across Teams, SharePoint, and Endpoint. DLP Strategy & Policy: Help manage Data Loss Prevention (DLP) specifically for IRM and Data Protection offering Optimization of "Auto-labeling" policies that automatically encrypt documents containing PII, PHI, or Intellectual Property Alert Correlation: Use the Content Explorer to investigate what was shared and the Activity Explorer to understand how it was shared Create weekly "Risk Snapshots" for leadership, visualizing trends in sensitive data exfiltration attempts. Technical Qualifications Education: Degree in Cybersecurity, Behavioral Science, Data Analytics, or Information Systems and/or six years of hands on experience Analytical Logic: Strong ability to use Boolean logic and Regular Expressions (Regex) to define sensitive data types. Microsoft 365 Core: Comfortable navigating the M365 ecosystem (understanding how a file moves from OneDrive to an external USB or Personal Cloud). Discretion: High level of integrity; this role involves handling highly sensitive information regarding company risk and employee behavior.

Skill Requirements

Key Responsibilities Insider Risk (IRM) Monitoring: Assist in reviewing anonymized alerts in the Microsoft Purview Insider Risk Management console - help identify patterns like "Data Resignation" (at-risk departing employees) or "Data Leaks" by correlating activity across Teams, SharePoint, and Endpoint. DLP Strategy & Policy: Help manage Data Loss Prevention (DLP) specifically for IRM and Data Protection offering Optimization of "Auto-labeling" policies that automatically encrypt documents containing PII, PHI, or Intellectual Property Alert Correlation: Use the Content Explorer to investigate what was shared and the Activity Explorer to understand how it was shared Create weekly "Risk Snapshots" for leadership, visualizing trends in sensitive data exfiltration attempts. Technical Qualifications Education: Degree in Cybersecurity, Behavioral Science, Data Analytics, or Information Systems and/or six years of hands on experience Analytical Logic: Strong ability to use Boolean logic and Regular Expressions (Regex) to define sensitive data types. Microsoft 365 Core: Comfortable navigating the M365 ecosystem (understanding how a file moves from OneDrive to an external USB or Personal Cloud). Discretion: High level of integrity; this role involves handling highly sensitive information regarding company risk and employee behavior.

Other Requirements

Key Responsibilities Insider Risk (IRM) Monitoring: Assist in reviewing anonymized alerts in the Microsoft Purview Insider Risk Management console - help identify patterns like "Data Resignation" (at-risk departing employees) or "Data Leaks" by correlating activity across Teams, SharePoint, and Endpoint. DLP Strategy & Policy: Help manage Data Loss Prevention (DLP) specifically for IRM and Data Protection offering Optimization of "Auto-labeling" policies that automatically encrypt documents containing PII, PHI, or Intellectual Property Alert Correlation: Use the Content Explorer to investigate what was shared and the Activity Explorer to understand how it was shared Create weekly "Risk Snapshots" for leadership, visualizing trends in sensitive data exfiltration attempts. Technical Qualifications Education: Degree in Cybersecurity, Behavioral Science, Data Analytics, or Information Systems and/or six years of hands on experience Analytical Logic: Strong ability to use Boolean logic and Regular Expressions (Regex) to define sensitive data types. Microsoft 365 Core: Comfortable navigating the M365 ecosystem (understanding how a file moves from OneDrive to an external USB or Personal Cloud). Discretion: High level of integrity; this role involves handling highly sensitive information regarding company risk and employee behavior.