Are you a data protection expert who loves building security controls that actually stop data from walking out the door? Do you want to architect and engineer enterprise-wide Data Loss Prevention for some of the world’s largest financial institutions? If so, you might be Fivesky’s next Senior Cloud Engineer!

Who you are

Experienced in Data Loss Prevention (DLP), cloud integration, and security engineering across enterprise environments.
Deeply familiar with networking, firewalls, and data protection technologies, and able to troubleshoot issues across the application and transport layers.
Capable of automating security processes using scripting languages and building workflows for incident alerting, response, and remediation.
A strong collaborator who partners with Operations and Network teams to deliver secure, stable, and scalable enterprise environments.
Bachelor’s Degree is required in Computer Science, Computer Information Systems, or Electrical Engineering.

It would be awesome if you had

Expertise in architecting and engineering DLP solutions integrated across user, network, email, and cloud environments.
Knowledge of Cloud Access Security Brokers (CASB/MCAS), Active Directory, Kerberos, and TLS encryption for enterprise data protection.
Experience with three-tier DLP installations, upgrades, health checks, and policy fine-tuning to reduce false positives.
Hands-on familiarity with network traffic analysis, VPN tunneling, NAT, and proxy configurations (PAC, ICAP, etc.).
A track record of designing and implementing automated, scalable security controls aligned to evolving business and compliance needs.

What you will do

Implement security controls in an enterprise environment and develop security solutions for information protection.
Architect and engineer DLP solutions across the enterprise environment and integrate DLP controls across user environments.
Advise on Data Loss Policy development as business needs evolve, and configure DLP policies to prevent data loss in email and web traffic.
Perform three-tier DLP installations and version upgrades in production, and conduct periodic health checks and performance assessments.
Create procedures and workflows for production deployment, and publish fixes in the knowledge base.
Configure network scans on DLP detection servers to identify sensitive data at rest and quarantine data classified as Restricted.
Generate data indexes/fingerprints remotely for use in Exact Data Match (EDM) detection rules within DLP policies.
Extend DLP capabilities to cloud applications using MCAS/CASB to monitor protected data in motion and at rest.
Automate security procedures using scripting languages based on the operating system in use.
Configure detection server settings to route traffic through specific TCP ports, and build DLP detection rules to monitor data stored and transferred from endpoint devices.
Configure prevent actions for HTTP/S, FTP, SMTP, SMB, SFTP, and other protocols, including web block, email encryption, and quarantine responses for outgoing traffic.
Troubleshoot network issues involving firewalls, traffic routing, proxies, and gateways across application and transport layer protocols.
Develop Proxy Auto Config (PAC) files to route traffic through defined proxy servers, and configure Network Prevent DLP detection servers to use ICAP.
Interpret network diagrams and apply knowledge of VPN tunneling, NAT, the OSI model, LAN/WAN, SSL, and packet trace analysis to structure DLP network architecture and traffic routing.
Configure Active Directory connections over TCP ports using LDAP, and enable Kerberos authentication by modifying Kerberos initialization files.
Configure Active Directory security group policies for DLP user/group exceptions to restrict data access and usage.
Generate key pairs and configure keys and certificates for end-to-end TLS email encryption.
Collaborate with Operations to troubleshoot production issues and perform root cause analysis on data loss caused by detection failures in network or email traffic.