Senior Data Security Engineer

Lead enterprise DLP engineering for TikTok USDS JV, owning policy and detection delivery, continuous improvement, and operational reliability across major DLP platforms.

Responsibilities

• Convert sensitive-data definitions, business workflows, and data-exfiltration scenarios into actionable DLP policies and detection logic.
• Design, test, deploy, and tune data protection controls across enterprise DLP platforms, including Forcepoint, Netskope, and Sublime Security, for endpoint, web, cloud application, and email data flows.
• Combine detection methods such as regular expressions, exact data matching, document fingerprinting, classification signals, and contextual conditions; apply LLM-based semantic analysis to identify protected data and assess exposure risk.
• Balance detection quality across accuracy, privacy, latency, and cost.
• Review policy outcomes and investigation feedback to reduce false positives, find missed detections, and improve alert prioritization.
• Create repeatable test cases covering sensitive-data detection, legitimate business activity, and potential control bypass patterns.
• Validate DLP controls before deployment and after significant platform or policy changes.
• Introduce changes using staged rollouts, documented approvals, and rollback plans to minimize business disruption.
• Review and manage policy exceptions with stakeholders, ensuring scope, ownership, justification, and expiration are clearly defined.
• Configure, maintain, and troubleshoot DLP platforms and integrations in partnership with IT and relevant system owners.
• Build monitoring for platform health, agent and connector coverage, policy deployment status, telemetry delivery, and alert routing.
• Investigate technical issues affecting inspection, enforcement, or visibility, coordinating resolution with internal teams and vendors.
• Develop dashboards and reporting for control coverage, alert quality, platform reliability, and recurring data-risk trends.
• Automate policy validation, event enrichment, reporting, and repetitive operational workflows using scripting and APIs.
• Integrate DLP signals with enterprise monitoring and case-management workflows, including deduplication, contextual enrichment, and escalation where appropriate.
• Act as a technical escalation point for complex DLP events, supporting Insider Security with detection interpretation, data movement validation, and understanding control limitations.
• Translate investigation findings into improvements to detection logic, preventive controls, and operational procedures.
• Handle sensitive event data according to approved access, privacy, retention, and confidentiality requirements.
• Drive data protection initiatives from requirements and design through deployment and operational handoff.
• Partner with IT, data owners, and business teams to understand legitimate workflows and close protection gaps.
• Maintain policy documentation, test results, runbooks, and design decisions; contribute to peer reviews and mentor less experienced engineers.

Requirements

• 5+ years of technical security experience, including 3+ years of hands-on enterprise DLP experience.
• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• Proven ability to independently design, test, deploy, and tune DLP policies, with strong hands-on expertise in Forcepoint DLP or Netskope DLP (not limited to platform administration or alert review).
• Experience with content inspection and contextual signals to detect sensitive data across endpoint, email, web, and cloud exfiltration paths, while balancing false positives, missed detections, and enforcement impact.
• Proficiency in Python or another scripting language for API-based automation; experience analyzing security telemetry using SIEM, log analytics, SQL, or equivalent tools.
• Ability to validate controls, manage production changes safely, and troubleshoot DLP platforms and enterprise integrations.
• Experience collaborating with incident response or insider-risk teams and communicating technical findings to both technical and non-technical stakeholders.
• Practical experience applying LLMs to data classification or security detection, including evaluating false positives and false negatives and handling sensitive data appropriately.

Technologies

• Forcepoint, Netskope, Sublime Security
• Python
• SIEM, log analytics, SQL
• LLM-based semantic analysis, LLM-based detection, LLMs
• Regular expressions, exact data matching, document fingerprinting, OCR

Benefits

• Day one access to medical, dental, and vision insurance
• 401(k) savings plan with company match
• Paid parental leave
• Short-term and long-term disability coverage
• Life insurance
• Wellbeing benefits
• 10 paid holidays per year
• 10 paid sick days per year
• 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure)

Preferred Qualifications

• Hands-on experience with both Forcepoint and Netskope, including cross-platform enforcement and deployment with endpoint, email, or cloud application teams.
• Experience developing and tuning Sublime Security MQL rules for outbound email data protection.
• Experience protecting intellectual property, source code, confidential documents, credentials, or regulated personal information using advanced detection methods such as exact data matching, document fingerprinting, OCR, or sensitivity labels.
• Experience building automated rule tests, version-controlled configuration workflows, telemetry enrichment, or case-management integrations.
• Familiarity with insider-risk scenarios and generative AI data exposure, including unusual transfers, personal-account use, external sharing, and employee transitions.
• Experience deploying LLM-based detection with prompt design, representative evaluation datasets, regression testing, and safeguards for privacy, reliability, latency, and cost.

About USDS

• TikTok USDS Joint Venture LLC focuses on the safety and security of millions of Americans who create, discover, and connect through the apps it operates.
• The joint venture was established in compliance with the Executive Order signed by President Trump on September 25, 2025.
• The company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.

Reasonable Accommodation

• USDS is committed to providing reasonable accommodations in recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs, or other reasons protected by applicable laws.

Location: Seattle, WA (onsite)

Compensation: USD 139,840 - 256,310 per yearly

Minimum Experience: 5 years

Education: Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent practical experience)