This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Wells Fargo is seeking a Senior Information Systems Engineer with deep expertise in Data Loss Prevention (DLP) policy authoring and content development. This role is responsible for designing, authoring, testing, and tuning DLP rules that protect sensitive data across email, endpoints, web, and SaaS/collaboration channels. The ideal candidate translates business and regulatory requirements into precise detection logic, continuously improves signal quality, and produces clear technical documentation and stakeholder communications. This role sits at the intersection of engineering, risk, and operations, partnering closely with Information Protection, Incident Response, Legal, Risk, and platform teams to implement effective, scalable DLP controls.
Job Responsibility:
Lead or participate in computer security incident response activities for moderately complex events
Conduct technical investigation of security related incidents and post incident digital forensics to identify causes and recommend future mitigation strategies
Provide security consulting on medium projects for internal clients to ensure conformity with corporate information, security policy, and standards
Design, document, test, maintain, and provide issue resolution recommendations for moderately complex security solutions related to networking, cryptography, cloud, authentication and directory services, email, internet, applications, and endpoint security
Review and correlate security logs
Utilize subject matter knowledge in industry leading security solutions and best practices to implement one or more components of information security such as availability, integrity, confidentiality, risk management, threat identification, modeling, monitoring, incident response, access management, and business continuity
Identify security vulnerabilities and issues, perform risk assessments, and evaluate remediation alternatives
Collaborate and consult with peers, colleagues and managers to resolve issues and achieve goals
Develop, maintain, and update DLP rules and policies under guidance, using techniques such as: Regular expressions, Keyword and dictionary‑based detection, Exact Data Match (EDM) / Indexed Data Match (IDM), Document fingerprinting, Classification labels and metadata
Assist in testing and validating detection logic to ensure policies function as intended across supported channels
Translate defined business requirements, regulatory obligations, and risk scenarios into: Detection logic components, Documented test cases and validation scenarios
Support promotion of policies from monitor to prevent by executing test plans and documenting outcomes
Participate in the investigation of DLP alerts, security events, and incidents to: Identify policy gaps, tuning opportunities, and contributing factors, Support post‑incident reviews by gathering evidence and observations, Escalate complex findings to senior engineers or incident response partners
Assist with tuning DLP policies to reduce false positives and false negatives using: Alert telemetry, Triage feedback, Guided experimentation and testing
Contribute to reporting on basic effectiveness metrics such as alert trends and suppression outcomes
Help develop and maintain: Operational runbooks and playbooks, Exception request workflows, User‑facing guidance and FAQs
Ensure documentation remains accurate and aligned with implemented controls
Partner with DLP Operations and Incident Response teams to: Triage alerts and investigate events, Analyze recurring issues and common false positives, Support corrective actions with data owners and application teams
Support internal audits and regulatory reviews by: Collecting evidence and artifacts, Assisting with documentation updates, Supporting periodic control reviews
Implement DLP rules in alignment with the organization’s information classification and labeling standards
Follow established coding, testing, and change‑management practices for policy updates
Learn and apply established DLP engineering standards, reusable patterns, and best practices
Actively seek feedback and guidance from peers & senior team members to build depth in DLP policy development and security controls
Requirements:
4+ years of Information Security Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
5+ years of Engineering experience, or equivalent demonstrated through work experience, training, military service, or education
5+ years of experience in information protection, DLP engineering, or security content development
Hands-on experience authoring and managing policies on one or more enterprise DLP platforms, such as: Microsoft Purview, Broadcom (Symantec) DLP, Forcepoint, Proofpoint, Zscaler, or equivalent technologies
Strong expertise in regex and pattern-matching techniques, with working knowledge of: EDM/IDM, Sensitive data types (PII, PHI, PCI), Data classification and labeling
Familiarity with modern collaboration and productivity platforms, including: Microsoft 365 (Exchange, SharePoint, OneDrive, Teams) and/or Google Workspace
Scripting and query proficiency (PowerShell, SQL, and/or Python) and experience working in Git-based version control and CI/CD workflows
Excellent written communication and documentation skills, with the ability to communicate effectively to both technical and non-technical audience
Nice to have:
Experience in financial services or other highly regulated industries, with familiarity with: NIST 800‑53 / 800‑171, ISO/IEC 27001, Data privacy and protection requirements
Knowledge of endpoint DLP, CASB/SSE, secure web gateways, email security, OCR, and document fingerprinting technologies
Background in exception governance and release‑code processes, balancing risk exposure, business needs, and user experience
Relevant certifications such as: SC‑400 or SC‑100, CISSP, CCSP, GIAC