Data Protection Engineer

Data Protection Engineer

Leidos has an immediate need for a highly skilled and versatile Data Protection Engineer to join the Network Execution Team supporting a critical Zero Trust initiative at U.S. Special Operations Command (USSOCOM). This role is essential for the tactical implementation of data-centric security controls across the Command's hybrid environment, ranging from commercial cloud capabilities on NIPR to the rigid, disconnected constraints of the SIPR and Top-Secret networks.

As a Data Protection Engineer, you will be the primary "hands-on-keyboard" implementer responsible for configuring, deploying, and tuning the encryption and labeling technologies that protect the Command's most sensitive data. You will translate the high-level architecture defined by the Chief Architect into concrete, enforceable policies within Microsoft Purview (for NIPR) and enterprise DRM platforms like Virtru or Kiteworks (for SIPR/Top Secret). You will move the Command from a passive "audit" posture to an active "block" posture, ensuring that data is encrypted and persistent protection travels with the file, regardless of where it is stored or transferred.

Responsibilities

• Microsoft Purview Implementation (NIPR): Configure and deploy Sensitivity Labels, Auto-labeling policies, and Data Loss Prevention (DLP) rules within the Microsoft 365 E5 suite to classify and protect CUI and PII in SharePoint, OneDrive, and Exchange.
• DRM & Encryption Configuration (SIPR/Top Secret): Implement and manage enterprise Digital Rights Management (DRM) solutions (specifically Virtru or Kiteworks) to enforce encryption-at-rest and attribute-based access control on classified networks.
• Policy Tuning & Enforcement: Oversee the phased transition of security policies from "Monitoring" mode to "Blocking" mode, analyzing false positives and tuning classifiers (Regex, Keyword Dictionaries, Trainable Classifiers) to minimize mission disruption.
• Endpoint Protection: Collaborate with the Trellix engineering team to ensure that data tags applied by Purview/DRM tools are correctly recognized and enforced by endpoint DLP agents on workstations.
• Cross-Domain Support: Assist in the manual "sneaker-net" transfer of policy updates and classification patterns to the air-gapped Top Secret environment, ensuring configuration consistency across all networks

Qualifications

Security Clearance: Active Top-Secret clearance with SCI eligibility (TS/SCI).

Education: Bachelor of Science (BS) degree in Systems Engineering, Computer Science, Cybersecurity, Electrical Engineering, or a related technical field.

Required Experience & Skills:

• Microsoft Purview Expertise: Significant (3+ years) hands-on experience configuring Microsoft Information Protection (MIP), Sensitivity Labels, and DLP policies in a large enterprise or DoD environment.
• DRM/Encryption Experience: Proven experience implementing and managing enterprise encryption and Rights Management tools such as Virtru, Kiteworks, or Seclore, particularly in on-premise or hybrid configurations.
• Data Classification: Strong understanding of data classification methodologies, including the creation of custom sensitive info types (SITs) using Regex and Exact Data Match (EDM).
• Technical Troubleshooting: Ability to diagnose and resolve complex issues related to encryption key management, policy propagation, and agent conflicts.

Certification Required: CompTIA Security+ CE (or higher) to meet DoD 8570 IAT Level II requirements.

Preferred Qualifications:

• Experience with Trellix DLP (formerly McAfee) endpoint products.
• Knowledge of NetApp BlueXP or BigID for data discovery.
• Prior experience supporting USSOCOM or working on SIPRNet/JWICS systems.
• Familiarity with DoD Data Strategy and CUI handling requirements.

Preferred Certifications:

• Microsoft Information Protection Administrator (SC-400).
• Virtru Certified Professional or Kiteworks Administrator Certification.

Come break things (in a good way). Then build them smarter. We're the tech company everyone calls when things get weird. We don't wear capes (they're a safety hazard), but we do solve high-stakes problems with code, caffeine, and a healthy disregard for "how it's always been done."