Senior Cloud Data Security Engineer – Data Loss Prevention (DLP)

CVS Health • New York, MA

2d • $101,970 - $203,940

About The Position

CVS Health is seeking a Senior Cloud Data Security Engineer to safeguard sensitive data across a large, regulated healthcare, pharmacy, and retail organization. As a senior member of the Data Protection Team, this role designs, implements, and advances enterprise-wide protections for data in motion, data in use, and cloud-hosted data. It leads DLP program development across cloud, endpoint, email, network, SaaS, and AI/ML environments, aligning protection capabilities with business objectives, regulatory requirements, and evolving cyber threats.

The position partners with Cybersecurity, Infrastructure, Cloud Engineering, Data Engineering, AI/ML, Enterprise Architecture, Privacy, Compliance, and business teams to prevent unauthorized disclosure, misuse, loss, or exfiltration of PHI, PII, PCI, and proprietary data. It drives data classification and labeling, improves visibility into data movement, and develops automated detection and response capabilities while minimizing operational friction.

As CVS Health expands its use of cloud services, AI, and machine learning, the role helps secure AI-enabled processes, address shadow AI risks, and protect sensitive information across AI/ML pipelines, model training environments, and generative AI platforms. The successful candidate brings deep expertise in enterprise DLP technologies, cloud security architectures, data governance, automation, and regulatory compliance, and can influence technical strategy, lead complex initiatives, and serve as a trusted subject matter expert.

Requirements

• At least 5 years of experience designing, implementing, and supporting enterprise cloud security and data protection solutions, with a strong emphasis on DLP in large-scale environments.
• At least 5 years of hands-on experience administering and optimizing enterprise DLP platforms such as Microsoft Purview, Zscaler, Palo Alto, or equivalent technologies.
• At least 5 years of experience creating, deploying, and enforcing DLP policies and controls across cloud, endpoint, email, network, SaaS, and collaboration platforms.
• At least 5 years of experience working with at least two major cloud platforms among AWS, Azure, and GCP to implement security and data protection controls.
• At least 5 years of practical experience with Zero Trust principles, CASB, CSPM, CNAPP, Conditional Access, and related cloud security frameworks.
• At least 5 years of responsibility for data classification, information protection, and governance initiatives involving PHI, PII, PCI, confidential, and proprietary data.
• At least 5 years of experience partnering with cybersecurity, engineering, infrastructure, compliance, and business stakeholders to investigate data security incidents, conduct root cause analysis, and drive remediation.
• Bachelor’s degree from an accredited university or equivalent work experience, defined as a high school diploma plus 4 years of relevant experience.

Nice To Haves

• Hands-on experience developing and tuning advanced DLP detection logic using Regex, dictionaries, Exact Data Match (EDM), fingerprinting, and related content inspection techniques.
• Proficiency with security analytics and reporting tools such as Splunk, Chronicle, Power BI, or comparable platforms.
• Experience implementing and supporting network security, email security, secure web gateway, proxy, and firewall technologies to prevent data exfiltration and unauthorized data movement.
• Experience securing AI/ML environments, including LLMs, generative AI solutions, AI agents, and MLOps platforms, with a focus on data protection, governance, and risk management.
• Demonstrated success leading DLP, information protection, or data security engineering initiatives and delivering enterprise-scale solutions through cross-functional collaboration.
• Experience supporting mission-critical security platforms in large enterprise environments, including participation in on-call rotations and providing off-hours and weekend support when required.
• Relevant certifications such as Microsoft Information Protection Administrator (SC-400), Microsoft Security Operations Analyst (SC-200), CCSP, CISSP, CCSK, AWS Security Specialty, or equivalent cloud and security certifications.
• Strong communication, stakeholder management, and problem-solving skills, including the ability to influence technical decisions and explain complex security concepts to technical and non-technical audiences.

Responsibilities

• Design, implement, and continuously mature enterprise DLP strategies, policies, and controls across cloud, endpoint, email, network, SaaS, and collaboration platforms.
• Lead the DLP program lifecycle, including data classification and labeling, policy development, rule tuning, incident management, investigations, root cause analysis, remediation, and continuous improvement.
• Architect and enhance cloud data protection capabilities across AWS, Azure, GCP, and hybrid environments using technologies and frameworks such as Microsoft Purview, CASB, CNAPP, CSPM, SASE, DSPM, Conditional Access, and Zero Trust.
• Design, implement, and enforce data protection controls for AI/ML platforms, generative AI solutions, LLMs, AI agents, MLOps pipelines, and shadow AI use cases.
• Develop dashboards, metrics, key risk indicators, and executive reporting to measure DLP effectiveness, control coverage, incident trends, and enterprise data protection posture.
• Automate policy enforcement, alert triage, and response workflows to improve operational efficiency.
• Partner with cybersecurity, privacy, compliance, legal, risk management, infrastructure, cloud engineering, data engineering, enterprise architecture, and business stakeholders to define data protection strategy, standards, governance processes, and roadmap priorities.
• Serve as an enterprise subject matter expert for DLP, cloud data security, and AI/ML data protection, providing guidance for cloud transformations, AI platform deployments, digital modernization, and other strategic programs.
• Ensure alignment with applicable industry frameworks and requirements, including NIST, CIS, CSA, HIPAA, PCI-DSS, and MITRE ATLAS.

Benefits

• Medical coverage
• Dental coverage
• Vision coverage
• Paid time off
• Retirement savings options
• Wellness programs
• Other resources, based on eligibility
• Eligible for a CVS Health bonus, commission, or short-term incentive program in addition to base pay

What This Job Offers

• Job Type: Full-time
• Career Level: Senior