IR Engineer II - DLP Response Engineer (Purview)

westernalliancebank; Phoenix (AZ); On-site; USD 120,000 - 180,000; Full time

Job summary

Western Alliance Bank is seeking an IR Engineer II - DLP Response Engineer (Purview) to manage and continuously improve Microsoft Purview Insider Risk and Data Loss Prevention capabilities. The role covers policy administration, alert triage, investigation support, and operational engineering across Insider Risk and DLP in a regulated financial setting.

You will work within Information Security and collaborate with IT, HR, Legal, and business stakeholders to balance risk mitigation with

Qualifications

• Hands-on administration of Purview Insider Risk Management and DLP capabilities.
• Experience with Purview policy administration, alert triage, and investigation support.
• Familiarity with governance of data loss prevention and insider risk controls.

Responsibilities

• Design, implement, test, maintain Purview policies and detection logic across DLP and Insider Risk.
• Monitor and tune policy thresholds, exceptions, and workflow configurations.
• Support AI-related data security risks and governance for Microsoft 365 Copilot and related tools.
• Triage alerts, validate evidence, and coordinate with internal teams during investigations.
• Create and maintain SOPs and runbooks for Purview DLP and Insider Risk workflows.

Skills

Purview

Insider Risk

Data Loss Prevention

Policy administration

Alert triage

Investigations

Tools

DTEX Intercept

Job description

Job Title: IR Engineer II - DLP Response Engineer (Purview)

Location:

Block 23

What you'll do:

The Insider Risk & DLP Response Engineer (Purview) is responsible for the hands-on administration, operation, triage, and continuous improvement of Western Alliance Bank's Microsoft Purview Insider Risk Management and Data Loss Prevention capabilities. This role combines Purview policy administration, alert triage, investigation support, control tuning, documentation, and operational engineering activities across Insider Risk Management, Data Loss Prevention, and related compliance capabilities.

This role will support a growing Insider Risk and Data Loss Prevention program within a large financial institution by helping validate alerts, maintain detection logic, improve policy fidelity, and support risk-based escalation workflows. The role is positioned within the Information Security function and is expected to partner with Information Technology, HR, Legal, Vendor Management, and business stakeholders while maintaining a practical balance between risk mitigation, regulatory expectations, and business productivity.

Design, implement, test, maintain, and continuously improve Microsoft Purview policies, detection logic, indicators, alert thresholds, exceptions, exclusions, and workflow configurations across Data Loss Prevention, Insider Risk Management, and related compliance capabilities.

Support the configuration and lifecycle management of sensitivity labels, Sensitive Information Types, trainable classifiers, policy tips, user notifications, and endpoint DLP controls.

Assist with testing new or modified Purview policies prior to production deployment, including validation of expected policy matches, alert generation, and downstream workflow behavior.

Support configuration, testing, and tuning of Microsoft Purview capabilities used to monitor and govern sensitive data interactions with generative AI tools, including Microsoft 365 Copilot and other approved or monitored AI experiences.

Monitor Purview feature updates and recommend practical improvements to existing operational workflows and policy configurations.

Review, validate, and triage Microsoft Purview DLP and Insider Risk alerts in accordance with established procedures and escalation criteria.

Assess alert context, supporting evidence, user activity, data movement, policy matches, and relevant system signals to determine whether additional review or escalation is warranted.

Review and triage AI-related security and compliance alerts generated through Microsoft Purview, including user activity involving sensitive data, generative AI interactions, policy matches, and related data movement indicators.

Support case management workflows, including evidence collection, disposition documentation, escalation routing, and coordination with appropriate internal teams.

Assist with recurring alert analysis to identify false positives, policy gaps, tuning opportunities, and control improvement recommendations.

Support complex investigations involving insider risk indicators, high-risk data movement, policy violations, privileged access concerns, and other scenarios requiring advanced technical validation and evidence review.

Support Microsoft Purview DLP policies across email, endpoint, cloud, collaboration, and Microsoft 365 workloads.

Assist with controls related to data exfiltration, unauthorized sharing, removable media, print activity, web/cloud upload scenarios, and other high-risk data movement channels.

Validate sensitive data detections, policy matches, and user notification outcomes to improve control effectiveness and reduce unnecessary alert noise.

Support operational alignment between Microsoft Purview DLP and Broadcom DLP, including triage coverage, policy interpretation, alert review, and escalation support as needed.

Partner with the broader Insider Risk and DLP function to support exception management, policy tuning, and control validation activities.

Support Microsoft Purview Insider Risk Management policies, indicators, alert queues, user activity review workflows, and case support processes.

Assist with triage of user activity signals involving potential data loss, policy violations, anomalous behavior, known leaver risk, or other insider risk scenarios.

Correlate Purview Insider Risk alerts with available contextual information from approved systems and workflows.

Support operational alignment between Microsoft Purview Insider Risk Management and DTEX Intercept, including triage coverage, alert review, use-case support, and escalation coordination as needed.

Help refine Insider Risk detection use cases to improve accuracy, consistency, and risk-based escalation.

Create and maintain SOPs, job aids, policy documentation, case-handling guidance, test plans, and operational runbooks for Purview DLP and Insider Risk workflows.

Help develop and maintain operational guidance for monitoring AI-related data security risks, including approved-use expect