Data Security Specialist / Data Security Analyst (Information Security)

Job Description

• Run stakeholder Servicesshops to identify data domains, critical data elements (CDEs), owners / stewards, and business processes.
• Build and maintain the data inventory / catalog (systems, datasets, flows, lineage) and keep ownership metadata current.
• Define and operationalize the data taxonomy (classification levels, handling rules) and ensure labels propagate across systems.
• Perform data discovery and gap assessments to locate sensitive data (e.g., PII,SPI) and reconcile scan results with the catalog.
• Translate privacy & policy requirements into controls (access models, masking, retention, encryption) and document control mappings.
• Design and enforce access control models (least privilege, RBAC / ABAC, purpose-based access), including periodic access reviews.
• Establish data protection baselines for storage, transfer, and processing (e.g., encryption in transit / at rest, key hygiene, segregation).
• Configure and tune DLP / egress policies across channels (endpoint, email, web / cloud, storage) and reduce false positives.
• Implement data masking / tokenization strategies for production, analytics, and non-prod environments; manage detokenization approvals.
• Define and monitor security telemetry (auth, data access, key usage, admin events) and create detections for anomalous data activity.
• Lead / assist data-related incident response (scoping, containment, evidence handling, root cause, corrective actions, lessons learned).
• Implement retention & disposal controls (schedules, holds, verification of deletion) and align backups / archives with policy.
• Assess third-party and SaaS data risks (contracts, DPAs, data flow reviews) and track remediation with vendors and owners.
• Produce dashboards and KPIs / KRIs (coverage, data classification completeness, DLP precision, access review closure, incident MTTR).
• Create and maintain documentation & training (standards, playbooks, runbooks, onboarding materials) and brief stakeholders regularly.

Requirements