Principal Security Engineer - AI & Copilot Data Protection

Role Summary

Seeking a Principal-level individual contributor to lead the secure enablement of Microsoft 365 Copilot and enterprise AI capabilities within Northern Trust's Cyber Team.

This role owns the end-to-end technical strategy, architecture, and operationalization of AI-driven data protection and compliance controls across Microsoft Purview, Defender, and M365 security services.

The Principal serves as the organization's deep technical authority on AI data protection
, shaping control strategy, influencing platform configuration decisions, and institutionalizing durable safeguards that reduce AI-driven data risk while enabling productivity at enterprise scale.

This is a hands‑on role with architect-level accountability
: designing systems that will stand up to audit, regulatory scrutiny, and adversarial pressure as AI usage scales.

This role is expected to:

• Own the technical vision and control strategy for AI and Copilot data protection, not just implement features.
• Define durable, repeatable patterns for securing LLM-enabled workflows that other teams can adopt.
• Operate with wide autonomy, minimal oversight, and direct influence across Security, Compliance, Privacy, M365, and Risk
  .
• Anticipate risk before incidents occur
  , translating emerging AI threats into preventive controls.
• Serve as escalation point and design authority for complex or ambiguous AI security decisions.

• Act as hands‑on technical lead and design authority for Copilot and enterprise AI security controls across Microsoft Purview, Defender, and M365.
• Define and evolve the AI data protection reference architecture
  , mapping controls to AI threat models and regulatory expectations.
• Review and harden Copilot platform configurations, including:
  • Web grounding and search behaviors
  • Agents, plugins, and connectors
  • Permission inheritance and identity context
  • Transcripts, prompt history, and retention models
• Ensure controls are designed for default-secure behavior
  , least privilege, and fail-safe operation.

• Design, implement, and operate AI-related controls spanning:
  • Information Protection and labeling strategy
  • DLP and Endpoint DLP (including AI-specific scenarios)
  • Insider Risk Management and Communication Compliance
  • Data Lifecycle Management and retention enforcement
  • DSPM for AI, including exposure detection and oversharing remediation
• Configure, deploy, troubleshoot, and operate controls across AD and EntraID environments.
• Support production changes through disciplined change management and approved deployment windows.

• Define AI-specific risk use cases
  , signals, and thresholds aligned to data exposure, misuse, and policy violation scenarios.
• Build monitoring, alerting, and automation for abnormal or high‑risk AI usage patterns
  .
• Develop operational runbooks that enable consistent response, investigation, and evidence preservation.
• Ensure solutions are audit‑ready, regulator‑defensible, and operationally sustainable
  .

• Translate AI threat models into policy‑aligned, enforceable technical controls
  .
• Partner with governance stakeholders to support:
  • AI risk assessments
  • Control mapping and documentation
  • Decision logs and exception handling
  • Executive and stakeholder reporting
• Contribute expert guidance to Copilot readiness, Zero Trust alignment, and broader AI governance initiatives.
• Track delivery and technical debt using Azure Dev Ops, establishing transparency and accountability.

• Define and enforce Copilot‑protected labels for files, groups, sites, and content sources.
• Prevent unauthorized content ingestion and unintended grounding into AI prompts.
• Expand browser and endpoint DLP protections, including:
  • Copy/paste and screen capture controls
  • AI prompt and response handling
• Operationalize DSPM for AI to continuously reassess exposure and remediate oversharing.
• Establish durable workflows for AI‑related insider risk and communication compliance scenarios.

• Deep understanding of LLM security fundamentals and threat…