Security Engineer - DLP and Insider threat

Overview

Design, implement and optimize Data Loss Prevention policies, build and tune SIEM detections, and automate security processes to strengthen data protection and detection capabilities.

What you'll do

• Innovate and automate tasks using Empower approved AI service where possible
• Engage with Legal and HR regarding ITM incidents with the guidance and leadership of other senior team members
• Gather supporting material and evidence for use during investigations and review this information with senior team members
• Conduct release reviews for routine release requests by following established processes
• Escalate requests when the request is not routine
• Deploy, manage, and optimize enterprise DLP solutions (Proofpoint, Microsoft Purview) across endpoints and cloud environments
• Perform weekly threat hunting to identify gaps in DLP protections, as well as the greater security posture as a whole
• Monitor for, and escalate events where Insider Threat activity has been found, such as anti-sleep programs being used, employee fraud, or use of unapproved/potentially dangerous applications
• Manage and create labels and labeling schemes for business project needs using both sensitivity labels and retention labels
• Work to integrate new and upcoming solutions such as Proofpoint AEDLP (Tessian)
• Design, tune, and validate rules in Proofpoint DLP to be sent to Splunk Enterprise Security to support threat detection and incident response
• Automate security workflows using PowerShell, Python and AWS services (Lambda, CloudFormation/CDK, DynamoDB, SQS, S3)
• Integrate security tools with SIEM/SOAR platforms to enhance visibility and response capabilities
• Work cross-functionally with security operations, detection engineering, and IT to improve security posture and processes for insider threat management

What you'll need

• Excellent communication skills for collaboration with Legal, HR, and executive stakeholders
• Bachelor's degree in Computer Information Systems, Cybersecurity (or related field), or equivalent experience
• AWS Solutions Architect Associate (or equivalent experience)
• 4+ years of experience in security engineering, detection engineering, or data protection
• Hands-on experience with DLP technologies (Proofpoint, Microsoft Purview) and SIEM platforms (Splunk ES)
• Strong Python and PowerShell scripting skills with experience in automation and cloud-native development
• Familiarity with networking fundamentals, and Linux environments
• Strong problem-solving skills with the ability to drive security improvements and cost-saving initiatives

Details

• Location: Nationwide remote
• Works in a professional office environment
• Remote and hybrid positions require reliable high-speed wired internet from fiber, cable or DSL and a dedicated home workspace with limited disruption; may be required to work in the office if home setup is inadequate
• Applicants must be authorized to work for any employer in the U.S.; no visa sponsorship, including CPT/OPT
• Base salary range $105,700.00 - $149,275.00; non-sales positions may participate in a bonus program
• Job posting end date: 11-12-2026