IR Engineer II - DLP Response Engineer (Purview)

Western Alliance Bank • Phoenix, AZ

2d • Onsite

About The Position

The Insider Risk & DLP Response Engineer (Purview) is responsible for the hands-on administration, operation, triage, and continuous improvement of Western Alliance Bank's Microsoft Purview Insider Risk Management and Data Loss Prevention capabilities. This role combines Purview policy administration, alert triage, investigation support, control tuning, documentation, and operational engineering activities across Insider Risk Management, Data Loss Prevention, and related compliance capabilities.

This role will support a growing Insider Risk and Data Loss Prevention program within a large financial institution by helping validate alerts, maintain detection logic, improve policy fidelity, and support risk-based escalation workflows. The role is positioned within the Information Security function and is expected to partner with Information Technology, HR, Legal, Vendor Management, and business stakeholders while maintaining a practical balance between risk mitigation, regulatory expectations, and business productivity.

Requirements

• 5+ years of experience in cybersecurity, information security, data protection, insider risk, security operations, compliance engineering, or a related technology function.
• High school diploma required; Bachelor's degree in related field preferred.
• Intermediate to advanced knowledge of applicable regulatory and legal compliance obligations, rules and regulations, industry standards and practices.
• Intermediate to Advanced experience administering, configuring, or supporting Microsoft Purview or Microsoft 365 security, compliance, or information protection capabilities.
• Intermediate to advanced experience reviewing, validating, or triaging security, compliance, DLP, insider risk, or user activity alerts.
• Working knowledge of data protection concepts, including sensitive data handling, data loss prevention, information protection, data classification, and risk-based monitoring.
• Experience correlating user activity, identity, endpoint, and data security telemetry.
• Ability to interpret policy requirements and translate them into practical technical configurations, control checks, or operational workflows.
• Strong analytical, documentation, troubleshooting, and communication skills, including the ability to clearly communicate technical findings to both technical and non-technical stakeholders.
• Ability to lead during high-pressure incidents and translate technical findings into business risk.
• Ability to handle sensitive matters with discretion, professionalism, and appropriate need-to-know handling.
• Advanced speaking and writing skills.

Nice To Haves

• Microsoft Purview DLP experience, including Endpoint DLP, Exchange/Teams/SharePoint/OneDrive DLP, policy tips, alert queues, custom rules, exceptions, and false-positive tuning.
• Microsoft Purview Insider Risk Management experience, including policy configuration, indicators, alert triage, user activity review, case workflows, and risk-based escalation support.
• Experience with Microsoft Purview Information Protection, sensitivity labels, encryption, auto-labeling, Sensitive Information Types, Exact Data Match, trainable classifiers, or data classification capabilities.
• Microsoft Certified: Information Security Administrator Associate (SC-401).
• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900).
• Microsoft Certified: Identity and Access Administrator Associate (SC-300).
• CISSP, CISM, Security+, GSEC, or similar security certification.

Responsibilities

• Design, implement, test, maintain, and continuously improve Microsoft Purview policies, detection logic, indicators, alert thresholds, exceptions, exclusions, and workflow configurations across Data Loss Prevention, Insider Risk Management, and related compliance capabilities.
• Support the configuration and lifecycle management of sensitivity labels, Sensitive Information Types, trainable classifiers, policy tips, user notifications, and endpoint DLP controls.
• Assist with testing new or modified Purview policies prior to production deployment, including validation of expected policy matches, alert generation, and downstream workflow behavior.
• Support configuration, testing, and tuning of Microsoft Purview capabilities used to monitor and govern sensitive data interactions with generative AI tools, including Microsoft 365 Copilot and other approved or monitored AI experiences.
• Monitor Purview feature updates and recommend practical improvements to existing operational workflows and policy configurations.
• Review, validate, and triage Microsoft Purview DLP and Insider Risk alerts in accordance with established procedures and escalation criteria.
• Assess alert context, supporting evidence, user activity, data movement, policy matches, and relevant system signals to determine whether additional review or escalation is warranted.
• Review and triage AI-related security and compliance alerts generated through Microsoft Purview, including user activity involving sensitive data, generative AI interactions, policy matches, and related data movement indicators.
• Support case management workflows, including evidence collection, disposition documentation, escalation routing, and coordination with appropriate internal teams.
• Assist with recurring alert analysis to identify false positives, policy gaps, tuning opportunities, and control improvement recommendations.
• Support complex investigations involving insider risk indicators, high-risk data movement, policy violations, privileged access concerns, and other scenarios requiring advanced technical validation and evidence review.
• Support Microsoft Purview DLP policies across email, endpoint, cloud, collaboration, and Microsoft 365 workloads.
• Assist with controls related to data exfiltration, unauthorized sharing, removable media, print activity, web/cloud upload scenarios, and other high-risk data movement channels.
• Validate sensitive data detections, policy matches, and user notification outcomes to improve control effectiveness and reduce unnecessary alert noise.
• Support operational alignment between Microsoft Purview DLP and Broadcom DLP, including triage coverage, policy interpretation, alert review, and escalation support as needed.
• Partner with the broader Insider Risk and DLP function to support exception management, policy tuning, and control validation activities.
• Support Microsoft Purview Insider Risk Management policies, indicators, alert queues, user activity review workflows, and case support processes.
• Assist with triage of user activity signals involving potential data loss, policy violations, anomalous behavior, known leaver risk, or other insider risk scenarios.
• Correlate Purview Insider Risk alerts with available contextual information from approved systems and workflows.
• Support operational alignment between Microsoft Purview Insider Risk Management and DTEX Intercept, including triage coverage, alert review, use-case support, and escalation coordination as needed.
• Help refine Insider Risk detection use cases to improve accuracy, consistency, and risk-based escalation.
• Create and maintain SOPs, job aids, policy documentation, case-handling guidance, test plans, and operational runbooks for Purview DLP and Insider Risk workflows.
• Help develop and maintain operational guidance for monitoring AI-related data security risks, including approved-use expectations, alert-handling procedures, evidence collection, and escalation criteria.
• Identify opportunities to improve queue management, alert dispositioning, evidence capture, workflow efficiency, and reporting consistency.
• Support audit, regulatory exam, control testing, and management reporting activities through factual documentation and evidence collection.
• Coordinate with Security Operations, Data Governance, Privacy, Legal, HR, IT, and business partners to support consistent handling of data loss prevention and insider risk events.
• Contribute to program maturity by recommending practical enhancements to policy coverage, triage workflows, data sources, and operational metrics.

Benefits

• competitive salaries
• an ownership stake in the company
• medical and dental insurance
• time off
• a great 401k matching program
• tuition assistance program
• an employee volunteer program
• a wellness program
• opportunity to bolster business knowledge
• learning the ins and outs of how successful companies operate and manage their finances
• invaluable hands-on experience to help grow your career

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: High school or GED