Security Engineer II - Cyber Operations

Hourly Pay Range: $47.57 - $73.74 - The hourly pay rate offered is determined by a candidate's expertise and years of experience, among other factors. Position Highlights:
Position:
Security Engineer II - Cyber Operations

Location:

Skokie, IL or Warrenville, IL or Arlington Heights, IL Full Time

Hours:

Monday-Friday, 8:00am- 4:30pm Hybrid Position Local travel to other corporate sites will be required as necessary.

As a Security Engineer II, Cyber Operations, at Endeavor Health, you will primarily support the organization’s Data Loss Prevention (DLP) program and strengthen the protection of sensitive information across email, cloud, and endpoint environments. You will operationalize and support DLP capabilities, including Microsoft Purview and endpoint DLP, through alert monitoring and investigation, policy administration and tuning, user and business-unit coordination, documentation, and follow-up.

The role also supports Insider Risk and related data-protection monitoring, including work involving HIPAA, PCI, and other sensitive-data requirements. You will develop and improve DLP procedures, case-management workflows, automation, and metrics to support timely, consistent investigations and demonstrate the effectiveness of DLP controls. DLP is the primary focus of this position though you will also support broader Cyber Operations responsibilities as assigned, including security incident response, administration of other security technologies, compliance activities, and cybersecurity projects.

This hybrid role will include a 24/7 on-call support rotation and requires sound judgment, technical expertise, project management, and clear communication with technical and business partners. Individuals should be proficient in using advanced security tooling and ensuring alignment with HIPAA, PCI, and other applicable laws, regulations, and standards. To be successful in this role, you will be expected to stay up to date on the latest solutions and technologies and advocate for the adoption of security and architecture best practices for the enterprise.

• Administer, monitor, maintain, and continuously improve DLP technologies and workflows, including Microsoft Purview and endpoint DLP, as capabilities are implemented and expanded.
• Triage and investigate DLP, Insider Risk, and other data-protection alerts across email, cloud, endpoint, and related environments; assess context, determine disposition, and coordinate appropriate user and business-unit follow-up.
• Conduct and support investigations and scans involving sensitive data and applicable requirements, including HIPAA, PCI, and other regulatory or organizational obligations; collect and preserve relevant evidence and document findings.
• Coordinate DLP incident response, containment, escalation, and remediation with Cyber Operations, the MSSP, business and clinical partners, and other stakeholders; track cases through resolution and capture lessons learned.
• Develop, maintain, and refine DLP policies, detection rules, runbooks, playbooks, investigation procedures, escalation criteria, and Service Now or other case-management workflows.
• Analyze alert outcomes and false positives and recommend improvements to DLP policies, detections, processes, and supporting tools.
• Develop DLP metrics and reports covering alert volume and disposition, investigation aging and workload, response performance, policy effectiveness, and workflow automation.
• Identify and implement appropriate automation for repeatable DLP tasks, including alert enrichment, evidence collection, case creation, notifications, and escalation; use SOAR or workflow tools where appropriate.
• Support broader Cyber Operations activities…