Sr Security Engineer - Data Loss Prevention (DLP)

Why UKG:

At UKG, the work you do matters. The code you ship, the decisions you make, and the care you show a customer all add up to real impact. Today, tens of millions of workers start and end their days with our workforce operating platform. Helping people get paid, grow in their careers, and shape the future of their industries. That's what we do.

We never stop learning. We never stop challenging the norm. We push for better, and we celebrate the wins along the way. Here, you'll get flexibility that's real, benefits you can count on, and a team that succeeds together. Because at UKG, your work matters-and so do you.

At UKG, security is at the core of everything we do. We are seeking a Security Engineer with a focus on Data Loss Prevention (DLP) to join our team. This individual will design, implement, and maintain security solutions and controls that safeguard sensitive data across the enterprise. The role requires expertise in DLP technologies, cloud access security, and zero-trust principles, with a strong ability to integrate these into enterprise-wide security strategies.

Job Responsibilities:

• Review, test, and implement security solutions related to:
• Data Loss Prevention (DLP): Microsoft Purview Information Protection, Conditional Access, policy configuration, monitoring, and incident response.
• Data Classification & Labeling: Define, implement, and maintain enterprise-wide data classification and labeling standards; leverage AI/ML-driven solutions to automatically classify and tag sensitive information.
• CASB Solutions: Manage inline (proxy-based) and out-of-band (API-based) CASB models to control access to and usage of SaaS applications.
• ZTNA Solutions: Integration and operation of Zero Trust Network Access solutions (e.g., Zscaler, Prisma Access, Axis) with DLP enforcement.
• Email Security: Integrate DLP and data classification policies with enterprise email security platforms.
• Public Cloud Security: Apply DLP and CASB controls in AWS, Azure, and Google Cloud Platform environments.
• Develop, enforce, and continuously improve data protection policies and security baselines.
• Monitor DLP systems for policy violations, anomalous activity, and potential data exfiltration; investigate incidents and drive remediation.
• Recommend enhancements to improve visibility and effectiveness of data classification, labeling, and protection capabilities.
• Maintain documentation of configurations, security policies, and operational procedures.
• Automate manual security tasks and policy enforcement where possible (infrastructure as code, scripting, orchestration).

Knowledge, Skills, and Abilities:

• Strong understanding of data security principles, data classification, and labeling frameworks.
• Hands-on experience with enterprise DLP platforms (Microsoft Purview strongly preferred).
• Experience with AI-driven data classification solutions and integration into security workflows.
• Familiarity with CASB deployment models (inline and out-of-band) and their application to SaaS platforms.
• Knowledge of Zero Trust frameworks and their application to DLP and access controls.
• Solid understanding of cloud security controls in AWS, Azure, and Google Cloud Platform.
• Familiarity with network and application protocols (TCP/IP, HTTP/S, DNS, etc.) and how they impact data protection.
• Experience with automation tools such as PowerShell, Terraform, Ansible, or equivalent is preferred.
• Excellent analytical, communication, and collaboration skills.
• Results-oriented, self-motivated, and capable of working in a fast-paced environment.

Qualifications:

• Minimum 5 years of experience in a Security Engineering role, with at least 3+ years focused on DLP, data classification, and data security technologies.
• Direct experience with data labeling and classification projects, ideally with AI/ML-driven automation.
• Working knowledge of security frameworks (NIST, ISO 27001, CIS, OWASP).
• Bachelor's or Master's degree in Information Systems, Information Security, or related field (preferred but not required).
• Industry-recognized certifications (CISSP, CISA, CISM, CCSP, or Security+) are strongly preferred.

Company Overview:

UKG is the Workforce Operating Platform that puts workforce understanding to work. With the world's largest collection of workforce insights, and people-first AI, our ability to reveal unseen ways to build trust, amplify productivity, and empower talent, is unmatched. It's this expertise that equips our customers with the intelligence to solve any challenge in any industry - because great organizations know their workforce is their competitive edge. Learn more at ukg.com.

Equal Opportunity Employer

UKG is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, disability, religion, sex, age, national origin, veteran status, genetic information, and other legally protected categories.

View The EEO Know Your Rights poster

UKG participates in E-Verify. View the E-Verify posters here.

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

Disability Accommodation in the Application and Interview Process

For individuals with disabilities that need additional assistance at any point in the application and interview process, please email

The pay range for this position is $99,800.00 to $143,450.00 USD, however, base pay offered may vary depending on skills, experience, job-related knowledge and location. This position is also eligible for a short-term incentive and a long-term incentive as part of total compensation. Information about UKG's comprehensive benefits can be reviewed on our careers site at