Security Specialist

Role Overview

Orion Innovation is seeking a Senior Data Security Practitioner to lead Phase 1 of an enterprise Data Security Posture Management (DSPM) platform selection program at one of the world's leading global financial institutions. The client is evaluating approximately ten DSPM vendor platforms against 300+ internal requirements using its own technical workbook and grading methodology. This is a high-visibility, senior client-facing role: the practitioner will refine and socialize requirements with client constituents across three global locations, run the vendor RFP and grading cycle, and present the down-select recommendation that reduces the field to 3–4 platforms for formal lab validation. The role demands equal parts deep data security expertise and executive-grade.

Key Responsibilities

•     Serve as the lead evaluator and day-to-day driver of Phase 1, accountable for the requirements package, vendor grading, and down-select deliverables

•     Re-evaluate, refine, and prioritize 300+ client data security requirements; socialize and validate them in workshops with business and technical constituents across New York, Glasgow, and Budapest

•     Package finalized requirements into the client's prescribed RFP format and manage issuance to approximately ten DSPM vendor partners

•     Manage the vendor response cycle, including Q&A traffic, clarifications, and submission logistics, maintaining full transparency with all vendor partners

•     Grade vendor responses against the client's accepted technical workbook and grading schedule; organize scoring, produce summary reporting, and document removal rationale per client criteria

•     Operate strictly within the client's evaluation methodology and governance — executing and elevating the client's process, not redesigning it; manage scope creep through formal change control

•     Present the down-select recommendation (3–4 finalist platforms) to client constituents and senior stakeholders

•     Build and document constituent relationships and evaluation context for structured handoff into the prime partner's lab validation phase (Phase 2)

•     Maintain weekly status reporting and escalate risks to the prime engagement lead, including realistic counsel on the aggressive 12-week client timeline

Essential Requirements

•     Minimum 10–12 years of experience in enterprise data security, with demonstrated depth across the full data security program lifecycle

•     Hands-on experience designing, implementing, or formally evaluating DSPM, DLP, and Data Access Governance (DAG) platforms for large multinational organizations; current knowledge of the DSPM vendor landscape (e.g., Varonis, Cyera, BigID, Securiti, Microsoft Purview, and peers)

•     Strong command of enterprise cryptography and HSM / key management program operations

•     Deep expertise in data classification, tagging, discovery, prioritization policy, and data lifecycle management at enterprise scale

•     Working understanding of the intersection of data security and identity (data access governance, entitlements, IAM integration)

•     Experience with data flows in hybrid compute environments spanning multi-cloud and on-premises estates with heterogeneous data handling and storage techniques; Microsoft Azure experience preferred

•     Understanding of current AI-related requirements for data security platforms — including data exposure risks from copilots, LLM integrations, and agentic systems

•     Python-based development capability and a programmatic / automation-first approach to security tooling; demonstrated capability in agentic coding approaches

•     Data security experience within a financial enterprise; fluency with regulatory and compliance expectations in strongly regulated environments (e.g., DORA, GDPR, FFIEC, NYDFS, GLBA — depth in at least one strong regime required)

•     Understanding of compliance governance and the typical data classification schemes required in a financial environment

•     Enterprise architecture literacy — able to read and reason about a complex data application stack, not only the security tooling layered on it

•     Experience with integration testing and lab-based proof of concept execution, with evidential reporting against formal acceptance criteria

•     Formal RFP / vendor evaluation experience with structured grading methodologies and evidential reporting

•     Exceptional written and verbal communication: able to run multi-stakeholder workshops, manage constituents across time zones, deliver executive reporting, and present findings to Director / MD-level audiences

•     Proven ability to work independently, make decisions, manage expectations, and re-prioritize in a fast-paced environment

•     Based in or commutable to New York, NY, with availability for regular on-site presence; approved delivery location per client Task Order: New York, NY

Desirable Qualifications

•     CISSP, CISM, CDPSE, or equivalent senior security/privacy certification

•     Prior engagement experience at Tier 1 Bank or an equivalent investment bank

•     Prior experience at a Big-4 firm, IBM, Accenture, or specialist data security consultancy

•     Familiarity with non-human identity (NHI) security trends and tooling

•     Availability and interest in continuing into Phase 3 (live-environment PoC) following the prime-led lab validation phase — continuity of client relationships is highly valued