Data Security Engineer

Pretium Enterprise Services•Scottsdale, AZ

1d•Hybrid

About The Position

Pretium Enterprise Services (PES) is seeking a hands-on, individual-contributor Data Security Engineer to implement, operate, and improve controls that protect sensitive information across Microsoft 365, SaaS applications, and cloud data platforms. The role has no direct reports and focuses on projects involving sensitive-data discovery and classification, data loss prevention (DLP), information protection, and exposure remediation. The engineer works with data owners, application owners, and security specialists to translate approved requirements into tested controls, resolve operational issues, and measure effectiveness while balancing protection with business usability. The position is hybrid, with three days a week in the Scottsdale, Arizona office preferred. Other locations that will be considered are Dallas, Texas; Charlotte, North Carolina; and California. The role offers an opportunity to join a collegial, entrepreneurial firm committed to team members’ personal and professional growth and a positive, encouraging work environment.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Computer Engineering, Software Engineering, or Information Technology.
Experience independently implementing and troubleshooting production data-security controls.
Ability to deliver defined projects, validate results, and escalate architectural decisions appropriately.
Hands-on Microsoft 365 data-protection experience, including Microsoft Purview DLP, sensitivity labels, and information-protection policies, or comparable experience with equivalent enterprise data-security platforms.
Practical experience onboarding data sources for discovery and classification, configuring scans, validating findings, and identifying coverage gaps.
Experience taking DLP or information-protection policies from requirements through testing, staged deployment, and production support.
Ability to investigate policy behavior, tune detection accuracy, manage exceptions, and explain business impact.
Ability to investigate effective access, excessive permissions, and external sharing in SaaS applications or data platforms, and work with application owners to remediate findings.
Working knowledge of data-protection principles, including encryption at rest and in transit, least-privilege data access, retention, and data minimization, with the ability to troubleshoot control gaps.
Ability to use PowerShell or Python and REST APIs to automate data-security checks, reporting, and remediation workflows.
Familiarity with version control, testing, error handling, and secure handling of credentials and sensitive data.
Strong troubleshooting, documentation, and collaboration skills.
Ability to explain findings, agree on remediation actions, and manage assigned work across multiple teams.

Nice To Haves

Experience with data security posture management (DSPM), cloud data stores, endpoint DLP, or integrating data-security alerts with security-monitoring platforms.
Experience assessing sensitive-data exposure through AI integrations or implementing technical retention controls.
Experience supporting multiple business units or tenants.
Relevant data-security certifications.

Responsibilities

Configure and maintain connectors and scans for prioritized structured and unstructured data sources.
Validate discovery coverage, classification accuracy, and scan health, and resolve gaps with platform owners.
Implement and troubleshoot sensitivity labels and information-protection policies, including approved encryption and usage restrictions; test policy behavior and usability before broader deployment.
Work with data and application owners to remediate excessive access, inherited permissions, and inappropriate external sharing of sensitive information; coordinate access changes with IAM teams and verify remediation.
Integrate data-security alerts and relevant audit events with security-monitoring and case-management workflows.
Partner with security operations to triage suspected data leakage, assess affected information, preserve evidence, and implement approved containment actions.
Assess SaaS and data-platform security configurations, including external sharing, application permissions, connected services, and audit logging; implement approved changes and validate effectiveness.
Translate discovery and exposure findings into prioritized remediation, considering information sensitivity, business use, and access paths; track corrective actions through validation and closure.
Engineer and tune DLP policies for prioritized email, collaboration, and endpoint use cases; test detection and enforcement, investigate missed detections and false positives, and use staged rollouts with documented exceptions and rollback procedures.
Implement assigned technical controls for retention and data minimization under requirements approved by Legal, Compliance, and data owners; validate changes with application owners.
Build maintainable scripts and API integrations for data-exposure analysis, discovery-coverage checks, evidence collection, and control validation, including testing, error handling, and secure credential management.
Partner with automation engineers on monitoring and repeatable workflows, cloud engineers on data-platform controls, and AI security engineers on data access through AI integrations.
Operate assigned data-security services and maintain runbooks, configuration records, and support procedures.
Report on discovery coverage, policy effectiveness, unresolved exposures, and exception aging, and use findings to prioritize control improvements.