The Senior Security Operations Engineer is responsible for designing, implementing, and improving Data Loss Prevention (DLP) protections across Included Health's corporate and cloud environments. You will lead hands-on deployment and tuning of DLP controls, including endpoint, network, and SaaS. You will investigate and respond to potential data exfiltration events. Additionally, you will drive remediation and hardening based on real-world incidents and detections.
You will own the operational lifecycle of our DLP stack. It involves building and refining policies, partnering with stakeholders to validate business-safe controls, automating response playbooks, and turning signals from alerts and logs into durable security improvements. You will also contribute to adjacent security operations functions, including incident response and vulnerability management, where they intersect with data protection.
You will play a crucial role within the Security Engineering team, reporting directly to the Senior Manager, Security Engineering. This is a remote role.
Responsibilities:
Lead the response to DLP and data security incidents, including investigation, containment, remediation, and root cause analysis for suspected data exfiltration or improper data handling.
Own the deployment, configuration, and continuous tuning of DLP controls across endpoints, network egress, SaaS applications, and cloud storage to protect PHI, PII, PCI, and other sensitive data.
Develop and maintain DLP policies, rules, and classifications that balance security, usability, and regulatory/client requirements.
Build and refine automated response playbooks and workflows that enrich, triage, and respond to alerts, reducing manual effort and mean time to respond.
Perform proactive hunting for anomalous data movement, including unusual destinations, channels, or volumes.
Define and track key DLP metrics (coverage, detection quality, MTTD/MTTR, false positive rate) and communicate progress to security leadership and cross-functional partners.
Qualifications:
Minimum 5+ years of hands-on experience in security operations, incident response, or security engineering roles, with a strong emphasis on data protection and DLP.
Direct, hands-on experience deploying, tuning, and operating
DLP tools (endpoint, network, SaaS, and/or cloud)
Cloud Access Security Broker (CASB) or similar SaaS security controls in a production environment.
DLP signals into SIEM/SOAR workflows (e.g., CrowdStrike, Splunk, Sentinel)
Advanced scripting/automation skills (e.g., Python, PowerShell, KQL/SQL) used to enrich, tune, and report on DLP/IR telemetry at scale.
Experience designing and maintaining data classification and policy frameworks for PHI, PII, PCI, and other sensitive data types.
Skills Required
- At least 5 years of hands-on experience in security operations, incident response, or security engineering, emphasizing data protection and DLP.
- Hands-on experience deploying, tuning, and operating endpoint, network, SaaS, and/or cloud DLP tools.
- Production experience with Cloud Access Security Broker (CASB) or similar SaaS security controls.
- Experience integrating DLP signals into SIEM/SOAR workflows, such as CrowdStrike, Splunk, or Sentinel.
- Advanced scripting and automation skills using Python, PowerShell, KQL, or SQL for DLP and incident-response telemetry.
- Experience designing and maintaining data classification and policy frameworks for PHI, PII, PCI, and other sensitive data types.
Included Health Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Included Health and has not been reviewed or approved by Included Health.
-
Healthcare Strength — Comprehensive medical, dental, and vision coverage with employer-paid contributions and free access to the company’s own services enhances total rewards. Feedback suggests robust mental health support, telemedicine, and wellness programs strengthen perceived care quality.
-
Parental & Family Support — Paid parental leave and family-building benefits, including fertility coverage and financial assistance for adoption and surrogacy, are seen as meaningful supports. Feedback suggests compassionate leave and free family access to care add tangible value for caregivers.
-
Leave & Time Off Breadth — Flexible, non‑accrued vacation, generous PTO, paid volunteer time, floating holidays, and sabbaticals are consistently emphasized. Feedback suggests remote‑friendly flexibility and additional rest days during high‑stress periods improve work-life balance.
Included Health Insights
What We Do
Included Health is a new kind of healthcare company, delivering integrated virtual care and navigation. We’re on a mission to raise the standard of healthcare for everyone. We break down barriers to provide high-quality care for every person in every community — no matter where they are in their health journey or what type of care they need, from acute to chronic, behavioral to physical. We offer our members care guidance, advocacy, and access to personalized virtual and in-person care for everyday and urgent care, primary care, behavioral health, and specialty care. It’s all included. Learn more at includedhealth.com.
Why Work With Us
Here, initiative meets purpose. We have bold aspirations that drive our work. We care in a way that shows in everything we do. At Included Health, you will join a team that is propelled by the opportunity to redefine healthcare for all. It's work worth caring about.
Gallery
