Specialist, Data Loss Prevention

White & Case•Tampa, FL

About The Position

White & Case is seeking an experienced Specialist, Data Loss Prevention (DLP) to lead the design, implementation, and ongoing management of data-protection and information-security controls across the firm. The role safeguards sensitive client, attorney, financial, privileged, and firm data while enabling attorneys and business professionals to work securely and efficiently. It partners with Information Security, IT, Risk, Compliance, Privacy, Legal, and business stakeholders to identify data risks and implement controls across endpoints, email, Microsoft 365, cloud applications, collaboration platforms, SaaS environments, and other data channels. The Specialist serves as the firm’s DLP subject-matter expert and develops a risk-based strategy, governance framework, operating model, and roadmap. The role reviews SOC escalations, leads high-risk investigations, preserves and documents evidence, prepares recommendations and legal handoff packages, and coordinates monitoring and confidentiality matters with Privacy and Legal. It also builds and tunes policies, rules, detection logic, workflows, exceptions, and enforcement actions; improves DLP coverage and alert quality; supports audits and client assessments; and translates client, regulatory, legal, privacy, and records-management requirements into practical controls. As the practice scales, the role provides technical leadership and mentorship to junior team members. The position reports to the Manager, Technology Policies and Compliance. White & Case LLP offers eligible employees a comprehensive benefits package. Exempt roles are also eligible for performance bonuses.

Requirements

At least 5 years of experience in security, investigations, compliance, SOC/security analysis, DFIR, e-discovery, fraud examination, audit, or related work.
Strong technical literacy with DLP alerts, telemetry, data classification, and exfiltration channels such as email, cloud sync, USB, print, screenshots, and personal webmail.
Demonstrated investigative discipline, including evidence handling, chain of custody, case documentation, and sound judgment when assessing intent under ambiguity.
Working knowledge of employee-monitoring practices, including notice, acceptable use, data minimization, confidentiality, and appropriate scope.
Excellent written and verbal communication skills, including the ability to translate complex technical issues into clear, defensible recommendations for non-technical audiences.
Integrity, discretion, impartiality, and sound judgment, including the ability to remain calm under pressure and resist undue influence.
Commercial awareness, intellectual curiosity, resourcefulness, initiative, and commitment to professional growth.
Collaborative approach and ability to build trust across Security, Legal, and the broader workforce.
Strong time-management skills and ability to manage multiple priorities effectively.
Fluency in English.

Nice To Haves

At least 7 years of relevant experience is preferred.
International experience.
CFE (Certified Fraud Examiner) paired with a privacy credential such as CIPP/US, CIPM, or CIPT; forensic certifications such as GCFA, GCFE, EnCE, or CHFI; or general security certifications such as CISM, CISSP, or Security+.
Hands-on experience with an insider-risk or DLP platform, such as Microsoft Purview, Forcepoint, Netskope, Zscaler, Broadcom/Symantec, or Splunk.
Familiarity with US legal touchpoints around workplace monitoring and sensitive data, such as ECPA/Stored Communications Act, state monitoring-notice laws, CCPA/state privacy laws, HIPAA, and export controls.
Experience mentoring or interest in building and leading a team.

Responsibilities

Serve as the firm’s subject-matter expert for Data Loss Prevention, information protection, and data-security controls.
Develop, maintain, and mature a risk-based DLP strategy, governance framework, operating model, and multi-year roadmap.
Define DLP controls based on data sensitivity, user role, business function, client requirements, regulatory obligations, and firm risk tolerance.
Assess DLP maturity, identify gaps, prioritize improvements, report progress through metrics, dashboards, and executive updates, and reduce SOC false positives.
Review SOC escalations and assess alerts based on content, user role, authorization, and normal business workflows.
Resolve false positives and sanctioned activity through manager, data-owner, or business confirmation as appropriate.
Lead high-risk investigations, preserve evidence, document findings, and maintain defensible case files.
Classify incidents as compromised account, accidental or negligent mishandling, or deliberate or repeated violation, and route them accordingly.
Prepare recommendations and legal handoff packages for General Counsel, HR, and other stakeholders as needed.
Coordinate with Privacy and Legal on monitoring scope, confidentiality, notice, and need-to-know access.
Identify trends indicating control weaknesses, insider-risk concerns, compromised accounts, or recurring policy violations.
Design, maintain, and document DLP policies, rules, detection logic, workflows, exceptions, and enforcement actions.
Expand DLP coverage across Microsoft 365, endpoints, email, cloud, collaboration, SaaS, web, removable media, and other exfiltration paths.
Tune policies using classification, sensitivity labels, content inspection, context, and user behavior to improve alert quality and reduce business disruption.
Help define and document standard operating procedures, disposition taxonomy, escalation criteria, and SLAs between SOC and Legal.
Provide technical leadership and mentorship to junior-level team members on casework, evidentiary discipline, and DLP implementation, testing, maintenance, investigations, and reporting.
Translate client-specific security obligations, outside counsel guidelines, contractual requirements, legal holds, records-management needs, and privacy obligations into practical DLP controls.
Support client assessments, audits, due diligence, questionnaires, and evidence requests related to DLP, monitoring, information barriers, insider risk, and data-exfiltration controls.
Ensure investigations involving attorneys, sensitive matters, or privileged information follow appropriate escalation, confidentiality, access, and need-to-know protocols.
Translate complex cybersecurity and DLP concepts into clear business requirements, practical guidance, and senior-leadership recommendations.