Senior Data Security Engineer - (Hybrid)

Key responsibilities:

• Engineer enterprise DLP controls across endpoint, email, SaaS, cloud storage, collaboration platforms, network, and web channels.

• Modernise DLP policy deployment by moving from manual console-based changes to version-controlled, automated, and repeatable policy-as-code workflows.

• Build CI/CD pipelines for data protection policy lifecycle management, including peer review, automated validation, testing, approval, deployment, and rollback.

• Develop reusable policy templates, detection logic, exception patterns, configuration baselines, and deployment standards across multiple DLP and CASB platforms.

• Automate operational tasks such as policy promotion, configuration drift detection, control validation, reporting, alert enrichment, and recurring health checks.

• Integrate DLP, CASB, data classification, cloud security, identity, SIEM, SOAR, and workflow platforms to improve visibility, response, and enforcement.

• Tune detection logic using data-driven analysis to reduce false positives, improve signal quality, and increase confidence in policy enforcement.

• Design guardrails for sensitive data usage across Microsoft 365, cloud platforms, source code repositories, collaboration tools, SaaS applications, and enterprise endpoints.

• Partner with engineering, cloud, infrastructure, network, compliance, privacy, legal, and business teams to design practical data protection solutions.

• Investigate data protection events, identify root cause, recommend control improvements, and convert lessons learned into automated prevention patterns.

• Define and maintain metrics, KPIs, dashboards, and control evidence that demonstrate risk reduction, policy effectiveness, deployment quality, and operational maturity.

• Support platform upgrades, capability expansions, vendor integrations, and new data protection control patterns using disciplined engineering practices.

Essential Skills:

• All applicants must demonstrate they have a legal right to work in the UK for employment at Allstate. Allstate is not providing sponsorship for this vacancy.

• A minimum of 4 years delivering enterprise Data Protection, Information Protection, Cloud Security, or Security Engineering capabilities within complex organisations.

• Proven experience in Policy-as-Code, Security-as-Code, and DevSecOps methodologies, with a demonstrated ability to automate security control deployment and governance at enterprise scale.

• Track record of replacing manual operational processes with engineering-driven solutions through automation, APIs, Infrastructure-as-Code, and platform engineering practices.

• Advanced knowledge of Data Loss Prevention (DLP), data classification, information protection, and data governance principles.

• Hands-on expertise with Microsoft Purview, Microsoft Information Protection, Defender for Cloud Apps, and the Microsoft 365 security ecosystem.

• Comprehensive understanding of cloud, SaaS, CASB, and enterprise data protection architectures.

• Proficiency in scripting and automation technologies including PowerShell, Python, REST APIs, Terraform, Bicep, YAML, JSON, or comparable tools.

• Demonstrated success in modernising Data Protection, DLP, CASB, or Information Protection programs through automation, standardization, and engineering-driven operating models.

• Proven ability to implement and scale DevOps, DevSecOps, or Platform Engineering practices within security organisations.

• Track record of leading large-scale security initiatives that improve control effectiveness, operational efficiency, and measurable risk reduction.

• Background supporting enterprise-scale cloud, SaaS, or Microsoft 365 environments.

Desirable Skills:

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent practical experience.

• Knowledge of regulatory, privacy, and compliance requirements and their implementation through scalable technical controls.

#LI-TR3

#LI-Hybrid