> Markdown version of [/jobs/ext/2553151-dlp-engineer](https://www.wearedevelopers.com/jobs/ext/2553151-dlp-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # DLP Engineer - **Company:** First Horizon Bank - **Location:** Memphis, TN, United States - **Contract:** Permanent contract - **Skills:** Microsoft Excel, Microsoft Windows, Audit Trail, Microsoft Online Services, Cloud Computing, Cloud Computing Security, Configuration Management, Collaborative Software, Cyber Security, System Configuration, Information Leak Prevention, Extract Transform Load (ETL), Data Security, Fraud Prevention and Detection, Web Browsers, Microsoft Security Essentials, Pattern Recognition, Power BI, Azure Active Directory, Kusto Query Language, Microsoft SharePoint, Security Information and Event Management, SQL Databases, Tableau (Software), Data Processing, Data Classification, Data Analytics, Enterprise Integration, Splunk, SentinelOne Expertise - **Published:** August 24, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=574cbc8c8c2c41ee ## About the Role * Experience in information security, data protection, security operations, incident response, threat analysis, compliance operations, criminology, law enforcement, corporate security, fraud investigation, or a related discipline. Candidates with transferable investigative experience are encouraged to apply. * Working knowledge of DLP concepts, data classification, sensitive data handling, insider risk, and common data exfiltration paths. * Ability to investigate alerts using evidence from users, devices, applications, email, collaboration platforms, and audit logs. * Experience configuring or tuning security policies, detections, rules, or alerting logic in an enterprise environment. * Strong analytical and problem-solving skills, including the ability to distinguish legitimate business activity from potential misuse. * Clear written and verbal communication skills, with the judgment to handle sensitive investigations professionally and confidentially. * Ability to manage multiple investigations and tuning efforts while maintaining accurate case documentation., * Hands-on experience with Microsoft Purview Data Loss Prevention, Endpoint DLP, Insider Risk Management, Information Protection, Data Explorer, Activity Explorer, or related capabilities. * Hands-on experience with Zscaler Data Loss Prevention (DLP), including policy configuration, content inspection, alert investigation, false-positive tuning, or data exfiltration controls across web, cloud applications and email. * Experience investigating Microsoft Purview alerts and incidents through Microsoft Defender or an integrated SIEM/SOAR workflow. * Experience using any endpoint detection and response (EDR) platform to investigate endpoint activity, correlate alerts, or support containment and remediation. Experience with comparable EDR tools is readily transferable to SentinelOne, which is used in this role. * Data analytics or reporting experience using Power BI, Tableau, SQL, Kusto Query Language (KQL), Excel, or similar tools. * Experience using any security information and event management (SIEM) platform for searching, correlation, dashboards, reporting, or investigation support. Experience with comparable SIEM tools is readily transferable to Splunk, which is used in this role. * Understanding of Microsoft 365 services, Microsoft Entra ID, endpoint management, audit logging, and cloud security concepts. * Experience in a regulated industry or with privacy, records management, legal, HR, or compliance stakeholders. * Relevant certifications, such as Microsoft Information Protection and Compliance Administrator (SC-400), Microsoft Security Operations Analyst (SC-200), Security+, or equivalent practical experience. * Professional experience in criminology, law enforcement, corporate security, fraud, investigations, or a similar field that demonstrates sound investigative judgment, evidence handling, interviewing, case management, or pattern analysis., You enjoy both sides of data security operations: working an alert through investigation and resolution, then using what you learned to improve the control that generated it. You can analyze technical evidence, understand business context, communicate findings without unnecessary jargon, and make thoughtful tuning decisions that balance protection with user productivity. ## Description We are seeking a hands-on Data Security & Insider Risk Analyst to protect sensitive information across Microsoft 365, endpoints, and other enterprise platforms. This role combines security operations with platform engineering: the analyst will investigate and respond to data loss prevention (DLP), insider risk, and endpoint security events while continuously tuning Microsoft Purview policies, detections, and workflows to improve accuracy and reduce risk. The ideal candidate is analytical, curious, and comfortable translating security data into clear findings and practical control improvements., * Monitor, triage, investigate, and respond to DLP, insider risk, and endpoint security alerts and incidents. * Determine incident scope, business context, data sensitivity, user activity, and potential impact; document findings and coordinate appropriate containment, escalation, and remediation. * Administer and tune Microsoft Purview DLP policies, rules, sensitive information types, classifiers, alert thresholds, exceptions, and user notifications. * Support DLP controls across Exchange, SharePoint, OneDrive, Teams, endpoints, browsers, removable media, printing, clipboard activity, and cloud applications, as applicable. * Review false positives, false negatives, user overrides, and recurring alert patterns; recommend and implement policy improvements. * Support Microsoft Purview Insider Risk Management use cases, indicators, policies, alerts, cases, and privacy-aware investigation workflows. * Partner with identity, corporate security, human resources, incident response teams, and line-of-business teams during investigations, containment, remediation, and control changes. * Use Microsoft Purview, Microsoft Defender, SentinelOne EDR, Splunk SIEM, audit, identity, and endpoint telemetry to build investigation timelines, correlate activity, and validate findings. * Create dashboards, metrics, and trend analyses that communicate incident volume, policy effectiveness, data movement, root causes, and control gaps. * Develop and maintain procedures, investigation playbooks, tuning standards, exception records, and knowledge articles. * Participate in testing, change management, and phased deployment of new or updated data protection controls. * Identify opportunities for automation, enrichment, and workflow integration that improve response speed and consistency., * DLP and insider risk alerts are investigated promptly, consistently, and with clear supporting evidence. * Policies become more effective over time, with fewer unnecessary alerts and better coverage of meaningful risk. * Incident trends and control gaps are translated into measurable recommendations for security and business partners. * Investigation procedures, tuning decisions, and exceptions are documented and repeatable. * Data security, endpoint security, and business stakeholders collaborate effectively on remediation and risk reduction. ## Related Videos - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Resilient by Design: Building Robust Architectures in High-Stakes Financial Systems](https://www.wearedevelopers.com/videos/2106-resilient-by-design-building-robust-architectures-in-high-stakes-financial-systems) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Beyond Dashboards: Fixing Text-to-SQL with Semantic RAG](https://www.wearedevelopers.com/videos/2036-beyond-dashboards-fixing-text-to-sql-with-semantic-rag) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [No Keys for the Robot: GitOps as the Control Plane for Autonomous Agents](https://www.wearedevelopers.com/videos/100095-no-keys-for-the-robot-gitops-as-the-control-plane-for-autonomous-agents) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)