Security Engineer || Hybrid - Sacramento, CA || 10+ Years Experience

Role: Security Engineer*

*Location : Sacramento, CA (Hybrid)*

*Type: Contract

Job Description:

1. The primary Subject Matter Expert (SME) must have a minimum of two (2) years of full-time equivalent (FTE) hands-on production experience assessing, translating, migrating, testing, and tuning Symantec/Broadcom DLP policies to Proofpoint Enterprise DLP, including Endpoint DLP and Email DLP.

2. SME must have a minimum of two (2) years of FTE experience designing, migrating, and enforcing Endpoint DLP policies covering sensitive data movement across USB/removable media, browser/cloud uploads, clipboard, printing, local applications, and other exfiltration channels, including Monitor to Block transitions.

3. SME must have a minimum of two (2) years of FTE experience migrating Symantec/Broadcom Email DLP policies into Proofpoint, including sensitive data detection tuning, blocking/quarantine workflows, encryption rules, user notifications, escalation processes, exceptions, and false positive reduction.

4. SME must have a minimum of two (2) years of FTE hands-on experience migrating or recreating Symantec/Broadcom CASB controls within Proofpoint CASB, including SaaS discovery, sanctioned/unsanctioned application policies, Application Programming Interface (API) based monitoring, inline controls, and sensitive data enforcement.

5. SME must have a minimum of two (2) years of FTE experience developing and enforcing geolocation based DLP and CASB policies to detect, restrict, or block access to sensitive information from unauthorized countries or regions.

6. SME must have a minimum of two (2) years of FTE experience using Proofpoint DLP, DSPM, and CASB to identify and remediate sensitive information that is publicly accessible, externally shared, anonymously accessible, or over permissioned across OneDrive, SharePoint, and other cloud repositories.

7. SME must have a minimum of two (2) years of FTE experience developing controls for public links, external recipients, guest accounts, unauthorized domains, excessive permissions, and unauthorized downloads or resharing involving sensitive data.

8. SME must have a minimum of two (2) years of FTE experience correlating IAM, CASB, DLP, DSPM, geolocation, and authentication indicators to detect high risk events such as unusual geographic access, abnormal downloads, repeated login attempts, or potential compromised accounts, and applying appropriate DLP/CASB protections.

9. SME must have a minimum of two (2) years of FTE hands-on experience integrating identity context—including user identity, group membership, device posture, application context, geography, risk level, and data classification—into DLP and CASB policies.

10. SME must have a minimum of two (2) years of FTE experience developing policies to detect and prevent sensitive information from being uploaded, pasted, or transmitted to unauthorized SaaS platforms or GenAI/LLM applications.

11. SME must have a minimum of two (2) years of FTE experience completing the full policy lifecycle: assessment, monitoring, incident volume analytics, false positive tuning, business validation, controlled testing, Block enforcement, exception handling, and rollback.

12. SME must have a minimum of two (2) years of FTE production-level experience across Symantec/Broadcom DLP, Symantec/Broadcom CASB, Proofpoint Enterprise DLP, Proofpoint Endpoint DLP, Proofpoint Email DLP, Proofpoint CASB, and Proofpoint DSPM, with direct responsibility for policy configuration, migration, troubleshooting, tuning, and enforcement.