Specialist, Data Loss Prevention

White-; Tampa (FL); On-site; USD 120,000 - 150,000; Full time

Job summary

White & Case seeks an experienced Specialist, Data Loss Prevention (DLP) to design, implement, and manage data-protection controls across endpoints, email, Microsoft 365, cloud apps, and SaaS environments. You will lead governance, policy design, and incident response in a law-firm setting.

Your role collaborates with Information Security, IT, Risk, Compliance, Privacy, Legal, and business stakeholders to mitigate data risks, reduce false positives, and ensure regulatory alignment.

Qualifications

• 5+ years in security, investigations, SOC/security analysis, DFIR, or related work
• Strong technical literacy with DLP alerts, data classification, and exfiltration channels
• Demonstrated investigative discipline with evidence handling and chain of custody
• Excellent written and verbal communication, able to translate complex issues for non-technical audiences
• Fluency in English; international experience preferred

Responsibilities

• Lead the DLP strategy, program leadership, governance, and multi-year roadmap
• Manage SOC escalations, alerts, investigations, and incident response
• Coordinate with Privacy and Legal on monitoring scope, confidentiality, and access
• Develop, tune, document DLP policies, rules, and enforcement actions
• Mentor junior team members and share best practices for DLP implementations

Skills

DLP knowledge

Investigation discipline

Communication skills

Regulatory awareness

Microsoft 365 security

Endpoint security

Team collaboration

Education

CFE

CIPP/US

Tools

Microsoft Purview

Forcepoint

Netskope

Zscaler

Splunk

Job description

Team SummaryNAPosition SummaryWe are seeking an experienced Specialist, Data Loss Prevention (DLP) to lead the design, implementation, and ongoing management of data-protection and information-security controls across the firm. This role safeguards sensitive client, attorney, financial, privileged, and firm data while enabling attorneys and business professionals to work securely and efficiently.The ideal candidate combines deep technical expertise in DLP and information protection with a strong understanding of the confidentiality, privacy, security, and regulatory requirements of a law firm. The role partners with Information Security, IT, Risk, Compliance, Privacy, Legal, and business stakeholders to identify data risks and implement effective controls across endpoints, email, Microsoft 365, cloud applications, collaboration platforms, SaaS environments, and other data channels.Duties and AccountabilitiesThe roles and responsibilities of this job include:DLP Strategy & Program LeadershipServe as the firm’s subject-matter expert for Data Loss Prevention, information protection, and data-security controls.Develop, maintain, and mature a risk-based DLP strategy, governance framework, operating model, and multi-year roadmap.Define DLP controls based on data sensitivity, user role, business function, client requirements, regulatory obligations, and firm risk tolerance.Assess DLP maturity, identify gaps, prioritize improvements, and report progress through meaningful metrics, dashboards, and executive updates and reduce SOC false positives.Monitoring, Investigations & Incident ResponseReview SOC escalations and assess alerts based on content, user role, authorization, and normal business workflows.Resolve false positives and sanctioned activity through manager, data-owner, or business confirmation as appropriate.Lead high-risk investigations, preserve evidence, document findings, and maintain defensible case files.Classify incidents as compromised account, accidental or negligent mishandling, or deliberate/repeated violation, and route each accordingly.Prepare clear recommendations and Legal handoff packages for General Counsel, HR, and other stakeholders as needed.Coordinate with Privacy and Legal on monitoring scope, confidentiality, notice, and need-to-know access.Identify trends indicating control weaknesses, insider-risk concerns, compromised accounts, or recurring policy violations.Program buildingDesign, maintain, and document DLP policies, rules, detection logic, workflows, exceptions, and enforcement actions.Expand DLP coverage across Microsoft 365, endpoints, email, cloud, collaboration, SaaS, web, removable media, and other exfiltration paths.Tune policies using classification, sensitivity labels, content inspection, context, and user behavior to improve alert quality and reduce business disruption.Help define and document the standard operating procedures, disposition taxonomy, escalation criteria, and SLAs between SOC and Legal.As the practice scales, provide technical leadership, mentorship to junior -level team members on casework and evidentiary discipline, and best practices for DLP implementation, testing, maintenance, investigations, and reporting.Translate client-specific security obligations, outside counsel guidelines, contractual requirements, legal holds, records-management needs, and privacy obligations into practical DLP controls.Support client assessments, audits, due diligence, questionnaires, and evidence requests related to DLP, monitoring, information barriers, insider risk, and data-exfiltration controls.Ensure DLP investigations involving attorneys, sensitive matters, or privileged information follow appropriate escalation, confidentiality, access, and need-to-know protocols.Translate complex cybersecurity and DLP concepts into clear business requirements, practical guidance, and senior-leadership recommendations.QualificationsThe qualifications for this role are:Required5+ years of experience, 7+ preferred, in security, investigations, compliance, SOC/security analysis, DFIR, e-discovery, fraud examination, audit, or related work.Strong technical literacy with DLP alerts, telemetry, data classification, and exfiltration channels such as email, cloud sync, USB, print, screenshots, and personal webmail.Demonstrated investigative discipline, including evidence handling, chain of custody, case documentation, and sound judgment when assessing intent under ambiguity.Working knowledge of employee-monitoring practices, including notice, acceptable use, data minimization, confidentiality, and appropriate scope.Excellent written and verbal communication skills, with the ability to translate complex technical issues into clear, defensible recommendations for non-technical audiences.Proven integrity, discretion, impartiality, and sound judgment, including the ability to remain calm under pressure and resist undue influence.Strong commercial awareness, intellectual curiosity, resourcefulness, initiative, and commitment to professional growth.Collaborative team player who can build trust across Security, Legal, and the broader workforce.Strong time management skills and ability to manage multiple priorities effectively.Fluency in English required; international experience preferred.PreferredCertifications: CFE (Certified Fraud Examiner) paired with a privacy credential ( CIPP/US , CIPM , CIPT), forensic certs ( GCFA , GCFE , EnCE , CHFI ) and general security certs ( CISM , CISSP , Security+ ).Hands-on experience with an insider-risk or DLP platform (e.g. Microsoft Purview, Forcepoint, Netskope, Zscaler, Broadcom/Symantec, Splunk).Familiarity with the US legal touchpoints around workplace monitoring and sensitive data (e.g. ECPA/Stored Communications Act, state monitoring-notice laws, CCPA/state privacy laws, HIPAA, export controls).Experience mentoring, or an interest in building and leading a team.This role reports toManager, Technology Policies and ComplianceEqual OpportunitiesWhite & Case is an Equal Employment Opportunity (EEO) employer and is committed to creating a fair workplace. It is our Firm’s policy to recruit, employ, train, compensate and promote without regard to race, color, religion, creed, national origin, age, gender, sexual orientation, marital status, military or veteran status, disability, genetic information, or any other category protected by applicable law.Applicants who are interested in applying for a position and require an accommodation during the process should contact [e-mail] at White & CaseWhite & Case LLP offers a comprehensive suite of benefit programs to all eligible employees, including medical, dental, and vision insurance, life and disability coverage, 401(k) retirement savings, vacation time, and leave programs (including parental leave). Exempt roles are also performance bonus eligible.The Firm may modify and amend any job description at any time in its sole discretion. Nothing herein creates a contract of employment or otherwise modifies the at-will nature of employment.The above is only a general description of the essential duties associated with this position and does not represent an exhaustive or comprehensive list of all duties.Note to Recruitment AgenciesOur internal Recruitment team manages all aspects of lateral hiring. All agencies must have signed terms of business—specific to the relevant office—before submitting any candidates. CVs or applications sent directly to White & Case partners or employees will also not be considered formal introductions. If you have questions, please contact the relevant Recruitment team. We work with our preferred suppliers when engaging agencies.