Senior Engineer, Data Protection & AI Security

Bain Capital•Boston, MA

23h

About The Position

Bain Capital’s Information Security team is seeking a Senior Engineer, Data Protection & AI Security to own and advance the firm’s data security posture and AI security capabilities. This is a hands-on engineering role responsible for deploying, operationalizing, and maturing the platforms and processes that protect the firm’s most sensitive data—across cloud environments, SaaS applications, databases, and AI workflows. The ideal candidate combines deep technical expertise in data security platforms (DSPM, DLP, data classification) with a forward-looking understanding of how AI adoption introduces new data risks. This person will work closely with Security Engineering, Cloud Operations, the Data Science team, and platform owners to build a cohesive data protection program—one that addresses both traditional data governance gaps and the emerging challenge of securing enterprise AI tools and workflows. This is not a monitoring or compliance role. This is an engineering role for someone who builds things, owns outcomes, and can operate independently in a fast-moving environment with a growing security platform portfolio.

Requirements

Hands-on experience deploying and operating Data Security Posture Management (DSPM) platforms
Strong working knowledge of cloud security in public cloud environments (AWS preferred), including IAM roles and policies, object storage security, VPC architecture, and infrastructure-as-code templates
Experience with enterprise DLP platforms and insider threat tools, including policy development, tuning, and incident workflows
Familiarity with data classification methodologies and tools across structured and unstructured data environments
Experience with SaaS Security Posture Management (SSPM) platforms
Working knowledge of AI/ML security concepts, including GenAI data leakage vectors, prompt injection risks, and shadow AI discovery
Experience integrating security tools via APIs and working with SOAR and automation platforms
Proficiency with cloud data warehouses, SQL databases, and cloud object storage from a security and access governance perspective
Familiarity with enterprise identity providers and identity governance platforms as they relate to data access controls
Bachelor’s degree in computer science, information security, or a related technical field (or equivalent professional experience)
7+ years of experience in information security, with at least 3 years focused on data security, data protection, or cloud security engineering
Demonstrated ability to own and drive complex, multi-stakeholder technical projects from planning through operationalization
Strong understanding of data privacy and protection regulations relevant to financial services (GLBA, SOX, SEC guidelines, GDPR)
Excellent written and verbal communication skills, with the ability to translate technical findings into business risk language for senior leadership
A self-starter with an ownership mindset who thrives in a lean team environment where independent judgment and initiative are expected

Nice To Haves

Experience in financial services, private equity, or asset management is strongly preferred
CISSP, CCSP, CCSK, AWS Security Specialty, or relevant GIAC certifications
Certifications in AI security (CAISP) or data privacy (CIPP/US) are a plus

Responsibilities

Own the end-to-end deployment, configuration, and operationalization of the firm’s DSPM platform, including onboarding data sources across public cloud environments, cloud data warehouses, SQL databases, and network file shares
Triage and prioritize DSPM findings, coordinate remediation with data owners and infrastructure teams, and build reporting workflows that translate discovery results into actionable risk reduction
Rationalize DSPM capabilities across the security tool portfolio to eliminate overlap between cloud-native application protection, DSPM, and endpoint-based data security platforms
Partner with Cloud Operations and application teams to navigate technical integration challenges, including IAM permissions, network connectivity, and change management processes
Design and implement a data classification framework that establishes sensitivity levels, ownership models, and handling requirements for the firm’s data
Develop and maintain data classification policies that inform downstream controls across DLP, DSPM, access governance, and backup immutability
Serve as the security team’s subject matter expert on data governance, partnering with Compliance and business stakeholders to align classification efforts with regulatory and operational requirements
Evaluate, deploy, and manage AI security monitoring tools to provide visibility into sanctioned and unsanctioned AI usage across the enterprise
Develop detection capabilities for sensitive data exposure through GenAI workflows, including monitoring for data leakage via AI prompts, outputs, and integrations with enterprise tools
Establish and maintain an AI governance operating model in coordination with the CISO and the Data Science team, including sanctioned tool inventories, acceptable use guardrails, and risk-based approval workflows for new AI applications
Stay current on evolving AI security frameworks (OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS) and translate emerging threats into practical defensive measures for the firm
Manage and enhance the firm’s DLP and insider threat platforms to prevent unauthorized data movement across endpoints, cloud applications, and email
Develop and tune DLP policies informed by DSPM discovery and data classification outputs, ensuring controls are risk-proportionate and operationally sustainable
Partner with Security Operations to integrate data protection alerts into the firm’s SOAR platform for automated triage and response workflows