Data Security Engineer

Pretium Enterprise Services, India•Scottsdale, AZ

1d•Hybrid

About The Position

Pretium Enterprise Services is seeking a hands-on individual contributor to implement, operate, and improve controls that protect sensitive information across Microsoft 365, SaaS applications, and cloud data platforms. The role has no direct reports and delivers projects focused on sensitive-data discovery and classification, data loss prevention (DLP), information protection, and exposure remediation. The engineer works with data owners, application owners, and security specialists to translate approved requirements into tested controls, resolve operational issues, and measure effectiveness while balancing protection with business usability. The position is hybrid, with three days a week in the office. Scottsdale, Arizona is the preferred location; Dallas, Texas; Charlotte, North Carolina; and California are also considered.

Requirements

Experience independently implementing and troubleshooting production data-security controls, delivering defined projects, validating results, and escalating architectural decisions appropriately.
Bachelor's degree in Computer Science, Cybersecurity, Information Security, Computer Engineering, Software Engineering, or Information Technology.
Hands-on Microsoft 365 data-protection experience, including Microsoft Purview DLP, sensitivity labels, and information-protection policies, or comparable experience with equivalent enterprise data-security platforms.
Practical experience onboarding data sources for discovery and classification, configuring scans, validating findings, and identifying coverage gaps.
Experience taking DLP or information-protection policies from requirements through testing, staged deployment, and production support; investigating policy behavior, tuning detection accuracy, managing exceptions, and explaining business impact.
Ability to investigate effective access, excessive permissions, and external sharing in SaaS applications or data platforms and work with application owners to implement remediation.
Working knowledge of data-protection principles, including encryption at rest and in transit, least-privilege data access, retention, and data minimization, with the ability to troubleshoot control gaps.
Ability to use PowerShell or Python and REST APIs to automate data-security checks, reporting, and remediation workflows.
Familiarity with version control, testing, error handling, and secure handling of credentials and sensitive data.
Strong troubleshooting, documentation, and collaboration skills; ability to explain findings, agree on remediation actions, and manage assigned work across multiple teams.

Nice To Haves

Experience with data security posture management (DSPM), cloud data stores, endpoint DLP, or data-security alert integration with security monitoring platforms.
Experience assessing sensitive-data exposure through AI integrations or implementing technical retention controls.
Experience supporting multiple business units or tenants.
Relevant data-security certifications.

Responsibilities

Configure and maintain connectors and scans for prioritized structured and unstructured data sources; validate discovery coverage, classification accuracy, and scan health; and resolve gaps with platform owners.
Implement and troubleshoot sensitivity labels and information-protection policies, including approved encryption and usage restrictions, and test policy behavior and usability before broader deployment.
Work with data and application owners to remediate excessive access, inherited permissions, and inappropriate external sharing; coordinate access changes with IAM teams and verify resolution.
Integrate data-security alerts and relevant audit events with security monitoring and case-management workflows; partner with security operations to triage suspected data leakage, assess affected information, preserve evidence, and implement approved containment actions.
Assess SaaS and data-platform security configurations, including external sharing, application permissions, connected services, and audit logging; implement approved changes with application owners and validate their effectiveness.
Prioritize remediation of discovery and exposure findings with data owners, considering information sensitivity, business use, and access paths; track corrective actions through validation and closure.
Engineer and tune DLP policies for prioritized email, collaboration, and endpoint use cases; test detection and enforcement, investigate missed detections and false positives, and use staged rollouts with documented exceptions and rollback procedures.
Implement assigned technical controls for retention and data minimization under requirements approved by Legal, Compliance, and data owners; validate changes with application owners. Enterprise retention policy and records management remain with designated business functions.
Build maintainable scripts and API integrations for data-exposure analysis, discovery-coverage checks, evidence collection, and control validation, including testing, error handling, and secure credential management.
Partner with automation engineers on monitoring and repeatable workflows, cloud engineers on data-platform controls, and AI security engineers on data access through AI integrations.
Operate assigned data-security services and maintain runbooks, configuration records, and support procedures.
Report on discovery coverage, policy effectiveness, unresolved exposures, and exception aging, and use findings to prioritize control improvements.