Data Protection Engineer

Leidos • Tampa, FL

7d

About The Position

Leidos has an immediate need for a highly skilled and versatile Data Protection Engineer to join the Network Execution Team supporting a critical Zero Trust initiative at U.S. Special Operations Command (USSOCOM). This role is essential for the tactical implementation of data-centric security controls across the Command's hybrid environment, ranging from commercial cloud capabilities on NIPR to the rigid, disconnected constraints of the SIPR and Top-Secret networks. As a Data Protection Engineer, you will be the primary "hands-on-keyboard" implementer responsible for configuring, deploying, and tuning the encryption and labeling technologies that protect the Command's most sensitive data. You will translate the high-level architecture defined by the Chief Architect into concrete, enforceable policies within Microsoft Purview (for NIPR) and enterprise DRM platforms like Virtru or Kiteworks (for SIPR/Top Secret). You will move the Command from a passive "audit" posture to an active "block" posture, ensuring that data is encrypted and persistent protection travels with the file, regardless of where it is stored or transferred.

Requirements

• Security Clearance: Active Top-Secret clearance with SCI eligibility (TS/SCI).
• Education: Bachelor of Science (BS) degree in Systems Engineering, Computer Science, Cybersecurity, Electrical Engineering, or a related technical field.
• Microsoft Purview Expertise: Significant (3+ years) hands-on experience configuring Microsoft Information Protection (MIP), Sensitivity Labels, and DLP policies in a large enterprise or DoD environment.
• DRM/Encryption Experience: Proven experience implementing and managing enterprise encryption and Rights Management tools such as Virtru, Kiteworks, or Seclore, particularly in on-premise or hybrid configurations.
• Data Classification: Strong understanding of data classification methodologies, including the creation of custom sensitive info types (SITs) using Regex and Exact Data Match (EDM).
• Technical Troubleshooting: Ability to diagnose and resolve complex issues related to encryption key management, policy propagation, and agent conflicts.
• Certification Required: CompTIA Security+ CE (or higher) to meet DoD 8570 IAT Level II requirements.

Nice To Haves

• Experience with Trellix DLP (formerly McAfee) endpoint products.
• Knowledge of NetApp BlueXP or BigID for data discovery.
• Prior experience supporting USSOCOM or working on SIPRNet/JWICS systems.
• Familiarity with DoD Data Strategy and CUI handling requirements.
• Microsoft Information Protection Administrator (SC-400).
• Virtru Certified Professional or Kiteworks Administrator Certification.

Responsibilities

• Microsoft Purview Implementation (NIPR): Configure and deploy Sensitivity Labels, Auto-labeling policies, and Data Loss Prevention (DLP) rules within the Microsoft 365 E5 suite to classify and protect CUI and PII in SharePoint, OneDrive, and Exchange.
• DRM & Encryption Configuration (SIPR/Top Secret): Implement and manage enterprise Digital Rights Management (DRM) solutions (specifically Virtru or Kiteworks) to enforce encryption-at-rest and attribute-based access control on classified networks.
• Policy Tuning & Enforcement: Oversee the phased transition of security policies from "Monitoring" mode to "Blocking" mode, analyzing false positives and tuning classifiers (Regex, Keyword Dictionaries, Trainable Classifiers) to minimize mission disruption.
• Endpoint Protection: Collaborate with the Trellix engineering team to ensure that data tags applied by Purview/DRM tools are correctly recognized and enforced by endpoint DLP agents on workstations.
• Cross-Domain Support: Assist in the manual "sneaker-net" transfer of policy updates and classification patterns to the air-gapped Top Secret environment, ensuring configuration consistency across all networks

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Number of Employees: 11-50 employees