Required Skills & Experience
Working knowledge of GDPR and ISO 27001 compliance requirements CCI knowledge (credit card information knowledge) 3–5 years of experience in Data Protection, DLP Engineering, or Information Security Hands-on experience with Microsoft Purview and DLP administration Strong understanding of data classification, tagging, and protection toolsets Experience handling and protecting sensitive data, including credit card information (CCI) Strong knowledge of AI security, with expertise in Claude preferred
Nice to Have Skills & Experience
Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience [Required] CIPP/E, CIPT, CISSP, CISM, or ISO 27001 Lead Implementer/Auditor [Preferred]
Job Description
Design, deploy, and maintain DLP policies and controls across endpoints, email, cloud storage, and SaaS applications using enterprise DLP tooling. Administer and optimize Microsoft Purview, including sensitivity labels, data classification, insider risk management, information barriers, retention policies, and compliance manager assessments. Establish and maintain data protection guardrails for AI tools, including Microsoft Copilot and Claude, covering data leakage prevention, prompt/response monitoring, access controls, and acceptable use policies. Partner with IT, legal, and business stakeholders to define data handling and governance standards for AI-generated content and AI-assisted workflows. Conduct data discovery and classification exercises to identify and protect sensitive, confidential, and regulated data across on-premises and cloud environments. Monitor DLP and Purview alerts, investigate policy violations, and drive remediation of data protection incidents. Maintain and support the organization's ISO 27001 information security management system (ISMS), including control documentation, internal audits, and continuous improvement activities. Ensure ongoing compliance with GDPR requirements, including data mapping, data subject access requests (DSARs), and privacy-by-design principles. Support compliance efforts related to China's Personal Information Protection Law (PIPL) where the organization processes data tied to Chinese data subjects or operations. Develop and deliver training and awareness materials on data protection, DLP, and safe AI usage for employees and stakeholders. Stay current on emerging AI governance frameworks, data protection regulations, and DLP/Purview product capabilities, recommending enhancements to the data protection program. Prepare reports, dashboards, and documentation for audits, regulators, and executive leadership.