Senior Cloud Engineer

Fivesky•Alpharetta, PA

19d

About The Position

Fivesky is seeking a Senior Cloud Engineer to implement enterprise security controls and develop information-protection solutions, with a focus on architecting and engineering Data Loss Prevention (DLP) across user, network, email, and cloud environments. The role supports large financial institutions and includes integrating DLP controls, advising on data loss policies, configuring detection and prevention rules, and extending DLP capabilities to cloud applications through MCAS/CASB. The engineer will install and upgrade production DLP systems, perform health checks and performance assessments, configure scans to find sensitive data at rest, and create fingerprints for Exact Data Match detection. The position also involves automating security procedures, configuring traffic routing and protocol-specific prevention actions, troubleshooting network and production issues, and developing incident alerting, response, and remediation workflows. The role collaborates with Operations and Network teams and uses SIEM tools to monitor suspicious activity and investigate DLP incidents. This is an FTE position based in Alpharetta, Georgia, or at unanticipated client sites within the United States. Compensation is based on experience and qualifications. Fivesky describes itself as a global technology solution provider serving financial-services firms, with a team culture focused on competitive compensation, professional development, career advancement, and fun.

Requirements

Experience with Data Loss Prevention (DLP), cloud integration, and security engineering in enterprise environments.
Familiarity with networking, firewalls, and data-protection technologies.
Ability to troubleshoot issues across application and transport layers.
Ability to automate security processes using scripting languages and build incident alerting, response, and remediation workflows.
Strong collaboration skills and ability to partner with Operations and Network teams.
Bachelor’s degree in Computer Science, Computer Information Systems, or Electrical Engineering is required.

Nice To Haves

Expertise architecting and engineering DLP solutions integrated across user, network, email, and cloud environments.
Knowledge of Cloud Access Security Brokers (CASB/MCAS), Active Directory, Kerberos, and TLS encryption for enterprise data protection.
Experience with three-tier DLP installations, upgrades, health checks, and policy fine-tuning to reduce false positives.
Hands-on familiarity with network traffic analysis, VPN tunneling, NAT, and proxy configurations such as PAC and ICAP.
A track record of designing and implementing automated, scalable security controls aligned with evolving business and compliance needs.

Responsibilities

Implement enterprise security controls and develop information-protection solutions.
Architect and engineer enterprise DLP solutions and integrate controls across user environments.
Advise on data loss policy development and configure DLP policies to prevent data loss in email and web traffic.
Perform three-tier DLP installations and production version upgrades; conduct periodic health checks and performance assessments.
Create procedures and workflows for production deployment and publish fixes in the knowledge base.
Configure network scans on DLP detection servers to identify sensitive data at rest and quarantine Restricted data.
Generate data indexes or fingerprints remotely for Exact Data Match detection rules.
Extend DLP capabilities to cloud applications using MCAS/CASB to monitor protected data in motion and at rest.
Automate security procedures using scripting languages suited to the operating system in use.
Configure detection server traffic routing through specific TCP ports and build rules to monitor data stored or transferred from endpoint devices.
Configure prevention actions for HTTP/S, FTP, SMTP, SMB, SFTP, and other protocols, including web blocking, email encryption, and quarantine for outgoing traffic.
Troubleshoot network issues involving firewalls, routing, proxies, and gateways across application- and transport-layer protocols.
Develop PAC files to route traffic through defined proxy servers and configure Network Prevent DLP detection servers to use ICAP.
Interpret network diagrams and apply knowledge of VPN tunneling, NAT, OSI, LAN/WAN, SSL, and packet-trace analysis to DLP architecture and traffic routing.
Configure Active Directory connections over TCP using LDAP and enable Kerberos authentication by modifying Kerberos initialization files.
Configure Active Directory security group policies for DLP user and group exceptions to restrict data access and usage.
Generate key pairs and configure keys and certificates for end-to-end TLS email encryption.
Collaborate with Operations to troubleshoot production issues and perform root-cause analysis of data loss caused by detection failures in network or email traffic.
Debug network traffic logs to resolve critical production issues and fine-tune detection-server memory settings based on traffic load.
Use SIEM tools to monitor suspicious user activity in network traffic.
Develop DLP incident alerting, response, and remediation workflows; analyze incidents to identify malicious insiders and false positives and fine-tune detection rules.
Build user attributes for identified DLP security incidents.
Modify firewall rules to enable communication between DLP detection servers and achieve detection coverage while following company firewall policy.