Lead DLP & Data Security Operations (Remote)

Included Health, Inc.; Northern (KY); Hybrid; USD 150,000 - 210,000; Full time

Benefits offered by this job

Remote-first culture

401(k) savings plan through Fidelity

Comprehensive medical, vision, and **d

Paid Time Off

12 weeks of 100% Paid Parental leave

Work-From-Home reimbursement

Job summary

Included Health, Inc. is seeking a Senior Security Operations Engineer to design, deploy, and tune DLP protections across endpoints, networks, SaaS, and cloud environments.

You will lead investigations, remediation, and hardening based on real-world detections within a remote role. You will own the DLP stack lifecycle, build automated playbooks, and collaborate with stakeholders to validate business-safe controls while contributing to incident response and vulnerability management.

Qualifications

• 5+ years in security operations or engineering focusing on data protection and DLP
• Hands-on deployment and tuning of DLP controls across endpoints, network, SaaS, and cloud
• Experience with CASB and SIEM/SOAR workflows
• Scripting/automation in Python/PowerShell/KQL/SQL
• Experience designing data classification for PHI/PII/PCI

Responsibilities

• Lead response to DLP and data security incidents, including investigation, containment, remediation, and root cause analysis for suspected data exfiltration or improper data handling
• Own the deployment, configuration, and continuous tuning of DLP controls across endpoints, network egress, SaaS applications, and cloud storage to protect PHI, PII, PCI, and other sensitive data
• Develop and maintain DLP policies, rules, and classifications that balance security, usability, and regulatory/client requirements
• Build and refine automated response playbooks and workflows that enrich, triage, and respond to alerts, reducing manual effort and mean time to respond
• Perform proactive hunting for anomalous data movement, including unusual destinations, channels, or volumes
• Define and track key DLP metrics (coverage, detection quality, MTTD/MTTR, false positive rate) and communicate progress to security leadership and cross-functional partners

Skills

DLP tooling

CASB

SIEM/SOAR

Python

PowerShell

KQL/SQL

Data classification

Incident response

Tools

DLP tools

CASB

Splunk

CrowdStrike

Job description

Included Health, Inc. is seeking a Senior Security Operations Engineer to design, deploy, and tune DLP protections across endpoints, networks, SaaS, and cloud environments.

You will lead investigations, remediation, and hardening based on real-world detections within a remote role. You will own the DLP stack lifecycle, build automated playbooks, and collaborate with stakeholders to validate business-safe controls while contributing to incident response and vulnerability management.