Data & AI Security Specialist Location: Durham, NC
ABOUT US:
Victra is Verizon’s largest premium retailer in the United States. We thrive on collaboration, innovation, and performance. Our mission is to “Connect technology to life in a trustworthy, fun, and profitable way”. We work closely with Verizon and our brand partners to deliver exceptional product offerings, promotions, and campaigns that drive in-store traffic and revenue.
JOB DESCRIPTION:
Do you want to be part of a culture that drives performance and celebrates success? Are you ready to protect what matters as AI changes how we work? As our Data & AI Security Specialist on the IT Cyber Security Operations team, you will protect Victra’s data, including customer, employee, and payment card information, across roughly 1,500 retail stores and our corporate teams, and you will secure the AI tools and agents that use it. You will design and run the controls that classify, label, protect, retain, and dispose of data; make sure AI tools and agents can reach only what they should; and confirm data and AI are secure before they are put to use.
You will work closely with the Knowledge and Data Governance Manager, who owns how Victra’s knowledge and data are organized, owned, and governed, and with the AI & Product Management team, who own AI governance: the acceptable use policy, use case approval, risk tiers, AI training, standard AI tool configurations, and the agent registry. This role owns the security controls and sign-off those decisions rely on. You will also partner with IT, Legal, Procurement, and business leaders.
You’re a hands-on, curious security professional who turns policy into working controls. You find where sensitive data lives, close the gaps, keep pace with how AI is changing the threat landscape, and explain risk in plain language to executives and store teams alike, all while living our company values of Performance, Collaboration, Celebration, Integrity, and Innovation.
Data cleanup comes first. Expect your first six to nine months to center on finding sensitive data, labeling, oversharing and access cleanup, and retention controls. AI security responsibilities will grow as Victra’s AI tools and agents scale.
KEY RESPONSIBILITIES:
- Design and maintain Victra’s data classification scheme and the handling requirements for each level, with approval from Cyber Security leadership and Legal.
- Discover where sensitive data lives across SharePoint, OneDrive, Teams, ServiceNow, file shares, and cloud storage; add sensitivity and location details to Victra’s data inventory maintained by the Knowledge and Data Governance Manager; and drive labeling of sensitive content, starting with the highest-risk locations.
- Configure and apply Microsoft Purview sensitivity labels across SharePoint sites, document libraries, Teams, and OneDrive, including default library labels, container labels for site privacy and external sharing, and auto-labeling for content that holds customer, employee, or payment card data.
- Classify data in SQL Server and Azure SQL databases by discovering and tagging tables and columns that hold sensitive data such as customer PII, CPNI, and cardholder data, using SQL data discovery and classification and Microsoft Purview scanning, and work with database owners in Software and Data Engineering on access, masking, and encryption for the most sensitive fields.
- Design, deploy, and tune data loss prevention policies across email, endpoints, collaboration tools, and AI tools, and set the security requirements for low-code platform connector and environment policies, which the platform administrators maintain.
- Review and remediate access to sensitive data, including oversharing, permissions cleanup, and security group hygiene, applying least privilege.
- Implement automated retention and disposal controls that enforce Victra’s records retention schedule, support legal holds and eDiscovery with Legal, and secure data during migrations so labels, permissions, and retention carry over correctly.
- Partner with Legal on Victra’s Document Retention Policy and records retention schedule, and turn them into Microsoft Purview retention policies and retention labels across email, SharePoint, OneDrive, and Teams, including disposition review for records that need sign-off before deletion.
- Assess oversharing and data exposure before AI tools and agents are rolled out, so AI surfaces only what each user is already allowed to see, and define the required security settings that AI & Product Management builds into standard AI tool configurations.
- Perform the security review of new AI tools, agents, connectors, and integrations as part of the AI governance review led by AI & Product Management, scaled to each solution’s risk tier and covering the data they can reach, the permissions they hold, and how API keys and secrets are stored and rotated.
- Manage identity and access for AI agents and other non-human accounts, so each agent has the least privilege it needs and an accountable owner.
- Apply data loss prevention to AI prompts and responses, and monitor AI activity for sensitive data exposure, unapproved AI tools, and unusual agent behavior, routing unapproved tools to the AI governance review for a decision.
- Security-test AI agents before launch, based on their risk tier, for prompt injection, sensitive data leakage, and excessive permissions, using recognized guidance such as the OWASP Top 10 for LLM and agentic applications. Accuracy and quality evaluation stays with AI & Product Management.
- Record security review results, data access, and permissions for each AI agent in the agent registry owned by AI & Product Management.
- Govern AI bots and agents across their lifecycle, including those built in Copilot Studio, Power Platform, and third-party tools: confirm each one is approved and in the agent registry, recertify its owner and access on a regular schedule, and disable or remove agents that are unapproved, unused, or no longer owned.
- Support PCI DSS compliance by locating cardholder data, minimizing where it is stored, and confirming it is protected and disposed of properly.
- Support CPNI, state privacy law, and carrier partner data requirements, including fulfilling consumer privacy requests with Legal.
- Investigate data exposure and AI-related security incidents, determine what data was affected, and support notification decisions with Legal under Victra’s incident response plan. AI issues that are not security issues, such as inaccurate or inappropriate outputs, go to AI governance.
- Review data and AI security for new applications and vendors through the security intake process, alongside AI & Product Management’s AI governance review and Legal’s contract review, and work with Procurement on security terms for data handling and the return or destruction of data.
- Review the security, privacy, and AI language in vendor contracts, master service agreements, data processing agreements, and statements of work; flag gaps to Legal and Procurement; and maintain standard security and AI clauses covering breach notification, audit rights, data location, use of Victra data to train AI models, and the return or destruction of data.
- Monitor data and AI security controls, report on coverage and effectiveness, manage time-limited security exceptions, and track issues to remediation with named owners and due dates.
- Provide documentation and evidence for data- and AI-related audits and assessments.
- Help write and maintain Victra’s information security policies, standards, and procedures in Victra’s standard policy format, including data classification, data handling, retention, AI acceptable use, and identity and access management, and support their annual review, approval, and rollout.
- Serve on the knowledge and data governance council and the AI governance review, providing the security standards and sign-off that governance decisions build on.
- Develop data handling and security awareness guidance and training, and provide the security content for AI training and acceptable use guidance owned by AI & Product Management.
WHAT WE ARE LOOKING FOR:
- 4 to 6 years in information security, data protection, or IT security, with hands-on data security responsibilities.
- Hands-on experience with Microsoft Purview (sensitivity labels, data loss prevention, data lifecycle management, eDiscovery, and data security posture management) or comparable tools.
- Working knowledge of Microsoft 365, SharePoint, OneDrive, Teams, and Entra ID permissions and access management.
- Working understanding of AI security risks, such as prompt injection, sensitive data disclosure, and excessive agent permissions, and how they apply to tools like Microsoft Copilot or other AI assistants.
- Understanding of PCI DSS data protection requirements and U.S. state privacy laws such as CCPA/CPRA.
- Experience investigating security incidents or data exposure.
- Ability to explain risk clearly to non-technical audiences and work across teams without direct authority.
- Strong organization and follow-through across many concurrent tasks.
- Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent experience.
- Nice to have: experience securing a Microsoft 365 Copilot or other enterprise AI rollout, including oversharing remediation and AI-specific data loss prevention, and experience reviewing or testing AI agents, connectors, or integrations, including API key and secrets management.
- Nice to have: familiarity with the OWASP Top 10 for LLM and agentic applications, MITRE ATLAS, the NIST AI Risk Management Framework, the NIST Cybersecurity Framework 2.0, or the NIST Privacy Framework; basic PowerShell or Python scripting for automation and investigation; and experience classifying data in SQL Server or Azure SQL databases, with enough SQL to find where sensitive data is stored.
- Nice to have: experience writing or updating information security policies, standards, or procedures; experience in a multi-location retail or telecommunications environment, or with CPNI or carrier partner data requirements; and certifications such as Microsoft Information Security Administrator (SC-401), CompTIA Security+, CISSP, CIPT, or CDPSE.
WHY JOIN US?
- Paid training and career development opportunities.
- Comprehensive health, dental, and vision insurance.
- 401k retirement plan.
- Tuition reimbursement.
- Employee discounts on Verizon services.
- Referral bonuses
- Career pathing opportunities.
EQUAL OPPORTUNITY EMPLOYER
We're proud to be an equal opportunity employer - and celebrate our employees' differences, regardless of race, color, religion, gender, sexual orientation, gender identity, national origin, age, disability, or Veteran status. Different makes us better.
