Cyber Security Engineer

Hybrid onsite (3 days a week) - Milwaukee, WI - MUST BE LOCAL

Pay: $58/hr.

About the Role

Join a specialized team of analysts and engineers dedicated to detecting and responding to insider risk events. This role focuses on engineering Microsoft E5 tools to strengthen enterprise data protection and insider threat detection capabilities. You will build secure-by-default solutions anchored in Microsoft Purview and related technologies, ensuring compliance and resilience at scale.

• Design and implement Microsoft Purview DLP policies across endpoints, Exchange, SharePoint, One Drive, and Teams.
• Develop and maintain Sensitivity Label taxonomy with automated enforcement paths.

• Create CI/CD workflows to version, test, and deploy DLP rules, label configurations, and governance artifacts across multiple environments.

• Connect Zscaler SSE inspection with Purview controls; route events to Splunk for analytics and detection.
• Leverage Crowd Strike telemetry to correlate endpoint behaviors with data movement signals for insider-risk and exfiltration scenarios.

• Build services and workflows (Azure Functions, Logic Apps, Graph API) for auto-remediation, revoking risky shares, and notifying data owners.
• Implement configuration baselines and drift detection for E5 security controls (MCAS, Conditional Access, etc.).

• Maintain reliability for data protection pipelines, including SLIs/SLOs, runbooks, and incident playbooks.
• Create Splunk dashboards and correlation searches aligned to exfiltration, anomalous access, and label violations.
• Partner with Privacy and Compliance for audit-ready controls and evidence processes.
• Work with IAM, Insider Risk, and platform teams to align label taxonomy and enforcement with business workflows.
• Provide technical leadership and mentorship for engineers and analysts implementing new E5 features.

• 5+ years of experience in enterprise security or platform engineering, with expertise in the Microsoft E5 security stack (Purview DLP, Information Protection, eDiscovery).
• Proven ability to build policy-as-code for DLP/labels and automate administration using Graph API and Power Shell.
• Experience designing secure-by-default guardrails for SaaS/AI adoption, including Copilot.

• Microsoft E5 / Purview:
  Information Protection, DLP, eDiscovery/Audit, Insider Risk