Job Title:

IR Engineer II - DLP Response Engineer (Purview)

Location:

Block 23

What you'll do:

The Insider Risk & DLP Response Engineer (Purview) is responsible for the hands-on administration, operation, triage, and continuous improvement of Western Alliance Bank's Microsoft Purview Insider Risk Management and Data Loss Prevention capabilities. This role combines Purview policy administration, alert triage, investigation support, control tuning, documentation, and operational engineering activities across Insider Risk Management, Data Loss Prevention, and related compliance capabilities.

This role will support a growing Insider Risk and Data Loss Prevention program within a large financial institution by helping validate alerts, maintain detection logic, improve policy fidelity, and support risk-based escalation workflows. The role is positioned within the Information Security function and is expected to partner with Information Technology, HR, Legal, Vendor Management, and business stakeholders while maintaining a practical balance between risk mitigation, regulatory expectations, and business productivity.

• Design, implement, test, maintain, and continuously improve Microsoft Purview policies, detection logic, indicators, alert thresholds, exceptions, exclusions, and workflow configurations across Data Loss Prevention, Insider Risk Management, and related compliance capabilities.
• Support the configuration and lifecycle management of sensitivity labels, Sensitive Information Types, trainable classifiers, policy tips, user notifications, and endpoint DLP controls.
• Assist with testing new or modified Purview policies prior to production deployment, including validation of expected policy matches, alert generation, and downstream workflow behavior.
• Support configuration, testing, and tuning of Microsoft Purview capabilities used to monitor and govern sensitive data interactions with generative AI tools, including Microsoft 365 Copilot and other approved or monitored AI experiences.
• Monitor Purview feature updates and recommend practical improvements to existing operational workflows and policy configurations.
• Review, validate, and triage Microsoft Purview DLP and Insider Risk alerts in accordance with established procedures and escalation criteria.
• Assess alert context, supporting evidence, user activity, data movement, policy matches, and relevant system signals to determine whether additional review or escalation is warranted.
• Review and triage AI-related security and compliance alerts generated through Microsoft Purview, including user activity involving sensitive data, generative AI interactions, policy matches, and related data movement indicators.
• Support case management workflows, including evidence collection, disposition documentation, escalation routing, and coordination with appropriate internal teams.
• Assist with recurring alert analysis to identify false positives, policy gaps, tuning opportunities, and control improvement recommendations.
• Support complex investigations involving insider risk indicators, high-risk data movement, policy violations, privileged access concerns, and other scenarios requiring advanced technical validation and evidence review.
• Support Microsoft Purview DLP policies across email, endpoint, cloud, collaboration, and Microsoft 365 workloads.
• Assist with controls related to data exfiltration, unauthorized sharing, removable media, print activity, web/cloud upload scenarios, and other high-risk data movement channels.
• Validate sensitive data detections, policy matches, and user notification outcomes to improve control effectiveness and reduce unnecessary alert noise.
• Support operational alignment between Microsoft Purview DLP and Broadcom DLP, including triage coverage, policy interpretation, alert review, and escalation support as needed.
• Partner with the broader Insider Risk and DLP function to support exception management, policy tuning, and control validation activities.
• Support Microsoft Purview Insider Risk Management policies, indicators, alert queues, user activity review workflows, and case support processes.
• Assist with triage of user activity signals involving potential data loss, policy violations, anomalous behavior, known leaver risk, or other insider risk scenarios.
• Correlate Purview Insider Risk alerts with available contextual information from approved systems and workflows.
• Support operational alignment between Microsoft Purview Insider Risk Management and DTEX Intercept, including triage coverage, alert review, use-case support, and escalation coordination as needed.
• Help refine Insider Risk detection use cases to improve accuracy, consistency, and risk-based escalation.
• Create and maintain SOPs, job aids, policy documentation, case-handling guidance, test plans, and operational runbooks for Purview DLP and Insider Risk workflows.
• Help develop and maintain operational guidance for monitoring AI-related data security risks, including approved-use expectations, alert-handling procedures, evidence collection, and escalation criteria.
• Identify opportunities to improve queue management, alert dispositioning, evidence capture, workflow efficiency, and reporting consistency.
• Support audit, regulatory exam, control testing, and management reporting activities through factual documentation and evidence collection.
• Coordinate with Security Operations, Data Governance, Privacy, Legal, HR, IT, and business partners to support consistent handling of data loss prevention and insider risk events.
• Contribute to program maturity by recommending practical enhancements to policy coverage, triage workflows, data sources, and operational metrics.

What you'll need:

• 5+ years of experience in cybersecurity, information security, data protection, insider risk, security operations, compliance engineering, or a related technology function.
• High school diploma required; Bachelor's degree in related field preferred.
• Intermediate to advanced knowledge of applicable regulatory and legal compliance obligations, rules and regulations, industry standards and practices.
• Intermediate to Advanced experience administering, configuring, or supporting Microsoft Purview or Microsoft 365 security, compliance, or information protection capabilities.
• Intermediate to advanced experience reviewing, validating, or triaging security, compliance, DLP, insider risk, or user activity alerts.
• Working knowledge of data protection concepts, including sensitive data handling, data loss prevention, information protection, data classification, and risk-based monitoring.
• Experience correlating user activity, identity, endpoint, and data security telemetry.
• Ability to interpret policy requirements and translate them into practical technical configurations, control checks, or operational workflows.
• Strong analytical, documentation, troubleshooting, and communication skills, including the ability to clearly communicate technical findings to both technical and non-technical stakeholders.
• Ability to lead during high-pressure incidents and translate technical findings into business risk.
• Ability to handle sensitive matters with discretion, professionalism, and appropriate need-to-know handling.
• Advanced speaking and writing skills.

Preferred

• Microsoft Purview DLP experience, including Endpoint DLP, Exchange/Teams/SharePoint/OneDrive DLP, policy tips, alert queues, custom rules, exceptions, and false-positive tuning.
• Microsoft Purview Insider Risk Management experience, including policy configuration, indicators, alert triage, user activity review, case workflows, and risk-based escalation support.
• Experience with Microsoft Purview Information Protection, sensitivity labels, encryption, auto-labeling, Sensitive Information Types, Exact Data Match, trainable classifiers, or data classification capabilities.
• Microsoft Certified: Information Security Administrator Associate (SC-401).
• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900).
• Microsoft Certified: Identity and Access Administrator Associate (SC-300).
• CISSP, CISM, Security+, GSEC, or similar security certification.

Benefits you’ll love:
We offer all the important things you'd want — like competitive salaries, an ownership stake in the company, medical and dental insurance, time off, a great 401k matching program, tuition assistance program, an employee volunteer program, and a wellness program. In addition, you’ll have the opportunity to bolster your business knowledge, learning the ins and outs of how successful companies operate and manage their finances, giving you invaluable hands-on experience to help grow your career!

About the company:

Western Alliance Bank, Member FDIC, is a wholly owned subsidiary of Western Alliance Bancorporation. Serving clients nationwide, Western Alliance Bank includes six legacy bank brands — Alliance Association Bank, Alliance Bank of Arizona, Bank of Nevada, Bridge Bank, First Independent Bank and Torrey Pines Bank — that remain part of the company’s heritage, as well as AmeriHome Mortgage, a Western Alliance Bank Company.

Western Alliance Bancorporation is committed to equal employment and will consider all qualified applicants without regard to race, sex, color, religion, age, nation origin, marital status, disability, protected veteran status, sexual orientation, gender identity or genetic information. Western Alliance Bancorporation is committed to working with and providing reasonable accommodations for individuals with disabilities. If you are an individual with a disability and require a reasonable accommodation to complete any part of the application process and/or need an alternative method of applying, please email [email protected] or call 602-386-2488.  When contacting us, please provide your contact information and state the nature of your accessibility issue.  We will only respond to inquiries concerning requests that involve a reasonable accommodation in the application process.

© Western Alliance Bancorporation