Principal Security Engineer - AI & Copilot Data Protection

Role Summary

Seeking a Principal-level individual contributor to lead the secure enablement of Microsoft 365 Copilot and enterprise AI capabilities within Northern Trust's Cyber Team. This role owns the end-to-end technical strategy, architecture, and operationalization of AI-driven data protection and compliance controls across Microsoft Purview, Defender, and M365 security services. The Principal serves as deep technical authority on AI data protection, shaping control strategy, influencing platform configuration decisions, and institutionalizing durable safeguards that reduce AI-driven data risk while enabling productivity at enterprise scale.

This is a hands‑on role with architect-level accountability: designing systems that will stand up to audit, regulatory scrutiny, and adversarial pressure as AI usage scales.

• Own the technical vision and control strategy for AI and Copilot data protection, not just implement features.
• Define durable, repeatable patterns for securing LLM-enabled workflows that other teams can adopt.
• Operate with wide autonomy, minimal oversight, and direct influence across Security, Compliance, Privacy, M365, and Risk.
• Anticipate risk before incidents occur, translating emerging AI threats into preventive controls.
• Serve as escalation point and design authority for complex or ambiguous AI security decisions.

• Act as hands‑on technical lead and design authority for Copilot and enterprise AI security controls across Microsoft Purview, Defender, and M365.
• Define and evolve the AI data protection reference architecture, mapping controls to AI threat models and regulatory expectations.
• Review and harden Copilot platform configurations, including:
  • Web grounding and search behaviors
  • Agents, plugins, and connectors
  • Permission inheritance and identity context
  • Transcripts, prompt history, and retention models
• Ensure controls are designed for default‑secure behavior, least privilege, and fail‑safe operation.

• Design, implement, and operate AI‑related controls spanning:
  • Information Protection and labeling strategy
  • DLP and Endpoint DLP (including AI‑specific scenarios)
  • Insider Risk Management and Communication Compliance
  • Data Lifecycle Management and retention enforcement
  • DSPM for AI, including exposure detection and oversharing remediation
• Configure, deploy, troubleshoot, and operate controls across AD and Entra
  
  ID environments.
• Support production changes through disciplined change management and approved deployment windows.

• Define AI‑specific risk use cases, signals, and thresholds aligned to data exposure, misuse, and policy violation scenarios.
• Build monitoring, alerting, and automation for abnormal or high‑risk AI usage patterns.
• Develop operational runbooks that enable consistent response, investigation, and evidence preservation.
• Ensure solutions are audit‑ready, regulator‑defensible, and operationally sustainable.

• Translate AI threat models into policy‑aligned, enforceable technical controls.
• Partner with governance stakeholders to support:
  • AI risk assessments
  • Control mapping and documentation
  • Decision logs and exception handling
  • Executive and stakeholder reporting
• Contribute expert guidance to Copilot readiness, Zero Trust alignment, and broader AI governance initiatives.
• Track delivery and technical debt using Azure Dev Ops, establishing transparency and accountability.

• Define and enforce Copilot‑protected labels for files, groups, sites, and content sources.
• Prevent unauthorized content ingestion and unintended grounding into AI prompts.
• Expand browser and endpoint DLP protections, including:
  • Copy/paste and screen capture controls
  • AI prompt and response handling
• Operationalize DSPM for AI to continuously reassess exposure and remediate oversharing.
• Establish durable workflows for AI‑related insider risk and communication compliance scenarios.

• Deep understanding of LLM security fundamentals and threat modeling, including:
  • Data exposure risks
  • Indirect…