Information Security Engineer and Data Protection

Lumenalta is seeking an experienced Information Security Engineer to implement and operate data protection tools, including ePHI discovery and inventory and a DSPM platform. The role also focuses on maturing DLP and SASE controls, supporting vulnerability remediation and incident response, and establishing guardrails for GenAI and shadow IT.

Responsibilities:

• Own ePHI discovery and inventory, finding, classifying, and inventorying ePHI across cloud storage, databases, file shares, and SaaS applications, and keeping that inventory accurate as systems change
• Implement a DSPM platform end to end, connecting data sources, tuning classifiers, identifying sensitive data that is over-exposed, unencrypted, or broadly accessible, and partnering with system owners to right-size access and fix misconfigurations
• Integrate supporting tooling such as asset inventory and data classification so discovery results feed the system of record, documenting configurations and runbooks along the way
• Mature DLP and SASE controls across the secure web gateway, CASB, DLP, and zero-trust stack by tuning policies to reduce false positives and negatives, strengthening enforcement, and building repeatable response processes for PHI movement events
• Establish GenAI and shadow IT guardrails by identifying unsanctioned AI and SaaS tools and applying policies that enable safe use while blocking what should not be allowed
• Support the vulnerability remediation lifecycle by monitoring critical public vulnerabilities, validating bug bounty, pen test, and scanner findings, routing them to the right teams, and confirming fixes
• Back up incident response using the established plan when the primary responder is unavailable, and investigate data exfiltration and insider risk events surfaced by data protection controls
• Partner with GRC by handing technical control gaps to the GRC analyst for tracking
• Support security operations including security tooling administration, TLS inspection exceptions, and technical off-boarding

Requirements:

• 7+ years in security engineering, with a proven track record of implementing security tools end to end, not only operating them
• Hands-on implementation experience with DSPM, data discovery, or data classification platforms
• Hands-on experience implementing and tuning DLP and SASE, SSE, or CASB solutions
• Deep understanding of how data is stored and accessed across major cloud platforms and SaaS applications
• Day-to-day use of AI tools to gain efficiency, plus an understanding of how to secure them
• Strong written and verbal communication skills
• candidates must be based in United States of America and align with the Pacific, Central, or Eastern, time zones to ensure effective collaboration with client and team schedules
• Healthcare or other highly regulated industry experience
• Vulnerability management or bug bounty triage experience
• Asset inventory or CAASM implementation experience
• Scripting experience (Python, PowerShell, JavaScript, or similar)
• Identity provider and SSO experience
• CISSP, GIAC, or similar certifications (not required)