Senior Cloud Engineer

Are you a data protection expert who loves building security controls that actually stop data from walking out the door? Do you want to architect and engineer enterprise-wide Data Loss Prevention for some of the world’s largest financial institutions? If so, you might be Fivesky’s next Senior Cloud Engineer!

Who you are:

• Experienced in Data Loss Prevention (DLP), cloud integration, and security engineering across enterprise environments.
• Deeply familiar with networking, firewalls, and data protection technologies, and able to troubleshoot issues across the application and transport layers.
• Capable of automating security processes using scripting languages and building workflows for incident alerting, response, and remediation.
• A strong collaborator who partners with Operations and Network teams to deliver secure, stable, and scalable enterprise environments.
• Bachelor’s Degree is required in Computer Science, Computer Information Systems, or Electrical Engineering.

It would be awesome if you had:

• Expertise in architecting and engineering DLP solutions integrated across user, network, email, and cloud environments.
• Knowledge of Cloud Access Security Brokers (CASB/MCAS), Active Directory, Kerberos, and TLS encryption for enterprise data protection.
• Experience with three-tier DLP installations, upgrades, health checks, and policy fine-tuning to reduce false positives.
• Hands-on familiarity with network traffic analysis, VPN tunneling, NAT, and proxy configurations (PAC, ICAP, etc.).
• A track record of designing and implementing automated, scalable security controls aligned to evolving business and compliance needs.

What you will do:

• Implement security controls in an enterprise environment and develop security solutions for information protection.
• Architect and engineer DLP solutions across the enterprise environment and integrate DLP controls across user environments.
• Advise on Data Loss Policy development as business needs evolve, and configure DLP policies to prevent data loss in email and web traffic.
• Perform three-tier DLP installations and version upgrades in production, and conduct periodic health checks and performance assessments.
• Create procedures and workflows for production deployment, and publish fixes in the knowledge base.
• Configure network scans on DLP detection servers to identify sensitive data at rest and quarantine data classified as Restricted.
• Generate data indexes/fingerprints remotely for use in Exact Data Match (EDM) detection rules within DLP policies.
• Extend DLP capabilities to cloud applications using MCAS/CASB to monitor protected data in motion and at rest.
• Automate security procedures using scripting languages based on the operating system in use.
• Configure detection server settings to route traffic through specific TCP ports, and build DLP detection rules to monitor data stored and transferred from endpoint devices.
• Configure prevent actions for HTTP/S, FTP, SMTP, SMB, SFTP, and other protocols, including web block, email encryption, and quarantine responses for outgoing traffic.
• Troubleshoot network issues involving firewalls, traffic routing, proxies, and gateways across application and transport layer protocols.
• Develop Proxy Auto Config (PAC) files to route traffic through defined proxy servers, and configure Network Prevent DLP detection servers to use ICAP.
• Interpret network diagrams and apply knowledge of VPN tunneling, NAT, the OSI model, LAN/WAN, SSL, and packet trace analysis to structure DLP network architecture and traffic routing.
• Configure Active Directory connections over TCP ports using LDAP, and enable Kerberos authentication by modifying Kerberos initialization files.
• Configure Active Directory security group policies for DLP user/group exceptions to restrict data access and usage.
• Generate key pairs and configure keys and certificates for end-to-end TLS email encryption.
• Collaborate with Operations to troubleshoot production issues and perform root cause analysis on data loss caused by detection failures in network or email traffic.
• Debug network traffic logs to resolve critical production issues, and fine-tune service memory settings based on traffic load on detection servers.
• Use Security Incident and Event Management (SIEM) tools to monitor suspicious user activity in network traffic.
• Develop DLP incident alerting, response, and remediation workflows, and analyze incidents to identify malicious insiders and false positives for detection rule fine-tuning.
• Build user attributes for identified DLP security incidents.
• Modify firewall rules to enable communication between DLP detection servers and ensure full detection coverage without violating company firewall policy.

Who we are:

• Fivesky is a fast-growing, global technology solution provider. We partner with the world’s largest financial service firms to deliver networking/infrastructure, cybersecurity, and cloud-based solutions for complex, global projects.
• At Fivesky, our employees are our greatest asset, and we strive to build a strong team culture centered on highly competitive compensation, professional development, career advancement, and fun.
• This is an FTE position in Alpharetta, GA or unanticipated client sites within the US . The compensation package is based on experience and qualifications. Benefits include: PTO/ paid sick leave, holidays, Health, Dental, and Vision insurance, and Retirement.
• Mail Resumes to: Fivesky, LLC, 1 Pennsylvania Plaza, Suite #2222, New York, NY 10119

(FS-RID-0467)