IR Engineer II - DLP Response Engineer; Purview

Job Title

IR Engineer II - DLP Response Engineer (Purview)

Block 23

The Insider Risk & DLP Response Engineer (Purview) is responsible for the hands‑on administration, operation, triage, and continuous improvement of Western Alliance Bank’s Microsoft Purview Insider Risk Management and Data Loss Prevention capabilities. This role combines Purview policy administration, alert triage, investigation support, control tuning, documentation, and operational engineering activities across Insider Risk Management, Data Loss Prevention, and related compliance capabilities.

This role will support a growing Insider Risk and Data Loss Prevention program within a large financial institution by helping validate alerts, maintain detection logic, improve policy fidelity, and support risk‑based escalation workflows. The role is positioned within the Information Security function and is expected to partner with Information Technology, HR, Legal, Vendor Management, and business stakeholders while maintaining a practical balance between risk mitigation, regulatory expectations, and business productivity.

• Design, implement, test, maintain, and continuously improve Microsoft Purview policies, detection logic, indicators, alert thresholds, exceptions, exclusions, and workflow configurations across Data Loss Prevention, Insider Risk Management, and related compliance capabilities.
• Support the configuration and lifecycle management of sensitivity labels, Sensitive Information Types, trainable classifiers, policy tips, user notifications, and endpoint DLP controls.
• Assist with testing new or modified Purview policies prior to production deployment, including validation of expected policy matches, alert generation, and downstream workflow behavior.
• Support configuration, testing, and tuning of Microsoft Purview capabilities used to monitor and govern sensitive data interactions with generative AI tools, including Microsoft 365 Copilot and other approved or monitored AI experiences.
• Monitor Purview feature updates and recommend practical improvements to existing operational workflows and policy configurations.
• Review, validate, and triage Microsoft Purview DLP and Insider Risk alerts in accordance with established procedures and escalation criteria.
• Assess alert context, supporting evidence, user activity, data movement, policy matches, and relevant system signals to determine whether additional review or escalation is warranted.
• Review and triage AI‑related security and compliance alerts generated through Microsoft Purview, including user activity involving sensitive data, generative AI interactions, policy matches, and related data movement indicators.
• Support case management workflows, including evidence collection, disposition documentation, escalation routing, and coordination with appropriate internal teams.
• Assist with recurring alert analysis to identify false positives, policy gaps, tuning opportunities, and control improvement recommendations.
• Support complex investigations involving insider risk indicators, high‑risk data movement, policy violations, privileged access concerns, and other scenarios requiring advanced technical validation and evidence review.
• Support Microsoft Purview DLP policies across email, endpoint, cloud, collaboration, and Microsoft 365 workloads.
• Assist with controls related to data exfiltration, unauthorized sharing, removable media, print activity, web/cloud upload scenarios, and other high‑risk data movement channels.
• Validate sensitive data detections, policy matches, and user notification outcomes to improve control effectiveness and reduce unnecessary alert noise.
• Support operational alignment between Microsoft Purview DLP and Broadcom DLP, including triage coverage,…