Senior Specialist, Data Loss Prevention

WHO WE ARE
HomeEquity Bank is a Schedule 1 Canadian chartered bank and the leading national provider of reverse mortgages, with a growing portfolio. As the only bank solely dedicated to serving homeowners 55 and up, we’re passionate about helping Canadian homeowners live retirement on their terms. We live that commitment every day, with a range of reverse mortgage solutions that include our flagship CHIP Reverse Mortgage™ product.
OUR VALUES, OUR PASSION
At HomeEquity Bank, our values drive and inspire our actions with our customers, our partners and each other.
Customer-Focused. Passionate Advocates
Courage to Act. Do the Right Thing
One Team. One Vision
Think Long-Term. Ever-Evolving
Be Exceptional. Inspire Greatness
POSITION SUMMARY
The Senior Specialist, Data Loss Prevention is the hands on technical authority behind our DLP and data security capability. The role is responsible for the configuration, tuning, and reporting of our data loss prevention and data security posture management platforms, and for designing the workflows that route and resolve data loss events. Accountability for the DLP program sits with the CISO.
The successful candidate will bring the operational reality, the tooling expertise, and the risk evidence that inform roadmap and enforcement decisions, and will be a primary voice in setting direction.
MAJOR ELEMENTS OF THE ROLE
Key responsibilities of this role include:
Program input and direction
Serve as the principal technical advisor to the CISO on DLP strategy, tooling investment, and enforcement posture
Recommend the roadmap and maturity plan, and build the risk based case behind each recommendation
Working with the data governance teams to maintain and improve the data classification taxonomy and sensitivity labelling scheme
Draft and maintain DLP standards and procedures for CISO approval, with the CISO as accountable policy owner
Represent DLP capability in audits, regulatory reviews, and third party assessments as the technical subject matter expert
Evaluate platforms and participate in vendor selection, proof of concept, and renewal decisions
Surface capability gaps, coverage blind spots, and emerging data risks early enough to influence planning cycles
Platform engineering and tuning
Configure, tune, collaborate, and continuously improve detection policies across email, collaboration and file sharing platforms, endpoints, cloud applications, and network egress
Configure, tune and advise on data discovery and classification tooling to build and maintain an inventory of sensitive data across cloud, SaaS, and on premise data stores
Assist with the implementation of sensitivity labelling, automated classification, and associated protection controls where needed
Reduce false positive volume through iterative rule refinement, exact data matching, document fingerprinting, machine learning classifiers, and context based conditions
Manage policy lifecycle from simulation and pilot through to enforcement, under documented change control
Integrate DLP telemetry into SIEM, SOAR, ITSM, and case management tooling
Support insider risk and communication monitoring capabilities where in scope
Workflow design
Design triage, escalation, and investigation workflows for DLP alerts, including severity models and proposed service level targets
Build the intake and exception process for business justified data movement, including approval paths and time bound exceptions
Define the handoff model with the SOC, HR, Legal, Privacy, and Compliance for insider risk and confirmed data loss events
Automate repetitive triage and enrichment steps to keep analyst effort focused on genuine risk
Reporting and metrics
Build and maintain operational dashboards and reporting on data risk, alert volumes, false positive rates, policy coverage, remediation timelines, and repeat offenders
Prepare the DLP content the CISO takes to executive, risk committee, and board audiences, translating technical findings into business risk language
Establish the metrics baseline and evidence measurable risk reduction over time
Stakeholder engagement
Partner with Privacy, Legal, HR, Data Governance, , and business data owners to validate what constitutes sensitive data and what enforcement is acceptable
Deliver awareness content and targeted coaching for teams generating high alert volumes
Support incident response as the DLP technical lead during suspected data exfiltration events
SKILLS AND EXPERIENCE REQUIRED
Qualifications
3 to 7 years in information security, with at least 2-3 years hands on with enterprise DLP or data security tooling
Deep hands on experience administering at least one enterprise DLP platform, including policy authoring, endpoint agent deployment, and enforcement tuning
Experience with data discovery, classification, or data security posture management tooling, and the ability to ramp quickly on an unfamiliar platform
Proven track record tuning a DLP deployment from noisy to trusted, with evidence of the outcome
Strong working knowledge of enterprise identity and collaboration platform administration
Practical understanding of data classification, encryption, rights management, and cloud access security broker concepts
Experience designing security workflows and writing the documentation to support them
Familiarity with privacy and financial services regulatory drivers: PIPEDA, provincial privacy legislation, OSFI B-13, and PCI DSS where applicable
Technical Skills
DLP policy engineering across email, endpoint, cloud, and network control points
Query languages for interrogating security and audit data
Scripting and automation for administration, integration, and reporting
API integration between security platforms
Data visualization and business intelligence reporting
Logging, detection, and alert pipelines within an enterprise SIEM
Working knowledge of at least one major cloud provider’s data storage and security services
Understanding of data stores in scope for discovery: relational and NoSQL databases, object storage, file shares, and SaaS repositories
Preferred
Experience in banking, insurance, or another regulated financial services environment
Experience migrating or consolidating between DLP platforms
Exposure to insider risk investigations conducted alongside HR and Legal
Certifications such as CISSP, CIPP/C, CCSP, or vendor certifications in a major DLP or data security platform
Experience with GenAI data leakage controls and shadow AI discovery
WORKING CONDITIONS UNIQUE TO JOB
Hybrid work environment
WHY WORK AT HOMEEQUITY BANK?
Great Environment
HomeEquity Bank offers a hybrid working environment supported with a culture of flexibility – an approach that is unique to each person, and that enables both business and individual needs to be met in a mutually beneficial way.
We pride ourselves in recognizing and celebrating performance, community service, teamwork, and diversity among our employees.
A Dynamic Culture – With People at the Centre
We believe our people make all the difference; our tireless commitment to inclusivity, professional development, and employee experience has been recognized through awards including the Greater Toronto’s Top Employers 2024,Waterstone Canada's Most Admired Corporate Cultures 2022-2023, the Globe and Mail's Report on Business: Canada's Top Growing Companies 2022 (third year since 2019), Canadian's Mortgage Professional (CMP) Top Mortgage Employer 2023 for the third year in a row and Achievers Top 50 Most Engaged Workplaces 2023.
Growth and Opportunities
We provide challenging and rewarding careers in a wide variety of fields. We continuously develop and train our employees through professional growth opportunities and on-the-job training. We also encourage our employees to develop professionally and personally though a series of career developing programs including our Educational Assistance Program, designed to reimburse costs related to professional learning and development.
Celebrating Great Work and People
We believe in an environment that celebrates success, knowledge, leadership, and work that is inspired by our core values. For these reasons, we have created several programs that make it easy for our employees to say ‘great job’ to their colleagues and leaders.
From our Appreciate! Program to the High Five Award Program and President’s Award Program, we recognize professional achievement with a variety of rewards including points towards gift cards, merchandise, and travel experiences, as well as group RRSP/DPSP contributions and more.
Our Community Leadership Program recognizes em