IT Operations Specialist I -3rd Party Risk, DLP, PKI

Fluor•Greenville, SC

5d•$83,000 - $154,000

About The Position

The 3rd Party Risk, DLP, and PKI Specialist supports Security Operations by evaluating third-party technology risk, managing data protection control requirements, and supporting certificate and key management governance. The role reviews vendor applications, contracts, Statements of Work, Data Processing Agreements, DLP/MIP requirements, and PKI-related risks to ensure external solutions and internal integrations meet security, privacy, and business requirements.

Requirements

Accredited four (4) year degree or global equivalent in applicable field of study and five (5) years of work-related experience or a combination of education and directly related experience equal to nine (9) years if non-degreed; some locations may have additional or different qualifications in order to comply with local requirements
Ability to communicate effectively with audiences that include but are not limited to management, coworkers, clients, vendors, contractors, and visitors
Job related technical knowledge necessary to complete the job
Ability to learn and apply knowledge of applicable local, state/province, and federal/national statutes and guidelines
Ability to attend to detail and work in a time-conscious and time-effective manner
Ability to coordinate with stakeholders and respond to time-sensitive vendor, contract, DLP, and certificate lifecycle issues.
Ability to communicate risk findings clearly to business owners, legal/privacy stakeholders, technical teams, and security leadership.
Ability to preserve defensible records for governance, audit, and risk management purposes.
Must be able to provide proof of US Citizenship

Nice To Haves

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Business, Risk Management, or a related field.
Experience performing third-party risk assessments, application risk reviews, vendor security reviews, or IT security analyst work in an enterprise environment.
Familiarity with Microsoft Purview DLP, Microsoft Information Protection sensitivity labels, data classification, evidence collection, and data-protection control design.
Working knowledge of PKI concepts, TLS certificates, certificate authorities, key management, signing/encryption certificates, renewal processes, and ownership practices.
Ability to review contracts, SOWs, DPAs, security questionnaires, SOC reports, penetration test summaries, and remediation evidence.
Relevant industry certifications such as CISSP, CISM, CRISC, CISA, Security+, or similar are preferred.
Strong attention to detail, note-taking, prioritization, and written communication skills, especially when documenting security review outcomes.

Responsibilities

Conduct risk assessments for new and existing third-party applications, vendors, integrations, and services, identifying security, privacy, data handling, access, and operational risks.
Review contracts, Statements of Work, Data Processing Agreements, security exhibits, and vendor responses to identify gaps requiring mitigation, contractual commitments, waivers, or risk-register entries.
Develop actionable remediation recommendations and coordinate with Legal, Privacy, HR, Compliance, Procurement, business owners, and IT teams to resolve open security concerns.
Support Microsoft Purview DLP and MIP-related activities, including policy requirements, reusable templates, naming conventions, evidence collection, exception handling, and audit artifacts.
Review and support PKI/certificate lifecycle concerns, including TLS certificates, signing certificates, certificate ownership, renewal accountability, encryption/key handling, and third-party certificate dependencies.
Monitor for unauthorized data transfers or inappropriate handling of sensitive information and support response activities when data-protection incidents or exceptions occur.
Maintain third-party risk review notes, decision records, evidence packages, operating procedures, and repeatable assessment templates.
Track emerging vendor, data-protection, DLP/MIP, and PKI risks and translate lessons learned into stronger review questions and control expectations.