Senior Specialist, Data Loss Prevention

WHO WE ARE

HomeEquity Bank is a Schedule 1 Canadian chartered bank and the leading national provider of reverse mortgages, with a growing portfolio. As the only bank solely dedicated to serving homeowners 55 and up, we’re passionate about helping Canadian homeowners live retirement on their terms. We live that commitment every day, with a range of reverse mortgage solutions that include our flagship CHIP Reverse Mortgage product.

OUR VALUES, OUR PASSION

At HomeEquity Bank, our values drive and inspire our actions with our customers, our partners and each other. Customer-Focused. Passionate Advocates Courage to Act. Do the Right Thing One Team. One Vision Think Long-Term. Ever-Evolving Be Exceptional. Inspire Greatness

POSITION SUMMARY

The Senior Specialist, Data Loss Prevention is the hands on technical authority behind our DLP and data security capability. The role is responsible for the configuration, tuning, and reporting of our data loss prevention and data security posture management platforms, and for designing the workflows that route and resolve data loss events. Accountability for the DLP program sits with the CISO. The successful candidate will bring the operational reality, the tooling expertise, and the risk evidence that inform roadmap and enforcement decisions, and will be a primary voice in setting direction.

MAJOR ELEMENTS OF THE ROLE

Key responsibilities of this role include:

• Program input and direction Serve as the principal technical advisor to the CISO on DLP strategy, tooling investment, and enforcement posture
• Recommend the roadmap and maturity plan, and build the risk based case behind each recommendation
• Working with the data governance teams to maintain and improve the data classification taxonomy and sensitivity labelling scheme
• Draft and maintain DLP standards and procedures for CISO approval, with the CISO as accountable policy owner
• Represent DLP capability in audits, regulatory reviews, and third party assessments as the technical subject matter expert
• Evaluate platforms and participate in vendor selection, proof of concept, and renewal decisions
• Surface capability gaps, coverage blind spots, and emerging data risks early enough to influence planning cycles
• Platform engineering and tuning
• Configure, tune, collaborate, and continuously improve detection policies across email, collaboration and file sharing platforms, endpoints, cloud applications, and network egress
• Configure, tune and advise on data discovery and classification tooling to build and maintain an inventory of sensitive data across cloud, SaaS, and on premise data stores
• Assist with the implementation of sensitivity labelling, automated classification, and associated protection controls where needed
• Reduce false positive volume through iterative rule refinement, exact data matching, document fingerprinting, machine learning classifiers, and context based conditions
• Manage policy lifecycle from simulation and pilot through to enforcement, under documented change control
• Integrate DLP telemetry into SIEM, SOAR, ITSM, and case management tooling
• Support insider risk and communication monitoring capabilities where in scope
• Workflow design
• Design triage, escalation, and investigation workflows for DLP alerts, including severity models and proposed service level targets
• Build the intake and exception process for business justified data movement, including approval paths and time bound exceptions
• Define the handoff model with the SOC, HR, Legal, Privacy, and Compliance for insider risk and confirmed data loss events
• Automate repetitive triage and enrichment steps to keep analyst effort focused on genuine risk
• Reporting and metrics
• Build and maintain operational dashboards and reporting on data risk, alert volumes, false positive rates, policy coverage, remediation timelines, and repeat offenders
• Prepare the DLP content the CISO takes to executive, risk committee, and board audiences, translating technical findings into business risk language
• Establish the metrics baseline and evidence measurable risk reduction over time
• Stakeholder engagement
• Partner with Privacy, Legal, HR, Data Governance, , and business data owners to validate what constitutes sensitive data and what enforcement is acceptable
• Deliver awareness content and targeted coaching for teams generating high alert volumes
• Support incident response as the DLP technical lead during suspected data exfiltration events

SKILLS AND EXPERIENCE REQUIRED

Qualifications

• 3 to 7 years in information security, with at least 2-3 years hands on with enterprise DLP or data security tooling
• Deep hands on experience administering at least one enterprise DLP platform, including policy authoring, endpoint agent deployment, and enforcement tuning
• Experience with data discovery, classification, or data security posture management tooling, and the ability to ramp quickly on an unfamiliar platform
• Proven track record tuning a DLP deployment from noisy to trusted, with evidence of the outcome
• Strong working knowledge of enterprise identity and collaboration platform administration
• Practical understanding of data classification, encryption, rights management, and cloud access security broker concepts
• Experience designing security workflows and writing the documentation to support them
• Familiarity with privacy and financial services regulatory drivers: PIPEDA, provincial privacy legislation, OSFI B-13, and PCI DSS where applicable

Technical Skills

• DLP policy engineering across email, endpoint, cloud, and network control points
• Query languages for interrogating security and audit data
• Scripting and automation for administration, integration, and reporting
• API integration between security platforms
• Data visualization and business intelligence reporting
• Logging, detection, and alert pipelines within an enterprise SIEM
• Working knowledge of at least one major cloud provider’s data storage and security services
• Understanding of data stores in scope for discovery: relational and NoSQL databases, object storage, file shares, and SaaS repositories

Preferred Experience

• Experience in banking, insurance, or another regulated financial services environment
• Experience migrating or consolidating between DLP platforms
• Exposure to insider risk investigations conducted alongside HR and Legal
• Certifications such as CISSP, CIPP/C, CCSP, or vendor certifications in a major DLP or data security platform
• Experience with GenAI data leakage controls and shadow AI discovery

WORKING CONDITIONS UNIQUE TO JOB

Hybrid work environment

WHY WORK AT HOMEEQUITY BANK?

Great Environment HomeEquity Bank offers a hybrid working environment supported with a culture of flexibility – an approach that is unique to each person, and that enables both business and individual needs to be met in a mutually beneficial way.

We believe our people make all the difference; our tireless commitment to inclusivity, professional development, and employee experience has been recognized through awards including the Greater Toronto’s Top Employers 2024, Waterstone Canada's Most Admired Corporate Cultures 2022-2023, the Globe and Mail's Report on Business: Canada's Top Growing Companies 2022 (third year since 2019), Canadian's Mortgage Professional (CMP) Top Mortgage Employer 2023 for the third year in a row and Achievers Top 50 Most Engaged Workplaces 2023.

Growth and Opportunities We provide challenging and rewarding careers in a wide variety of fields. We continuously develop and train our employees through professional growth opportunities and on-the-job training. We also encourage our employees to develop professionally and personally though a series of career developing programs including our Educational Assistance Program, designed to reimburse costs related to professional learning and development.

Celebrating Great Work and People We believe in an environment that celebrates success, knowledge, leadership, and work that is inspired by our core values. For these reasons, we have created several programs that make it easy for our employees to say ‘great job’ to their colleagues and leaders. From our Appreciate! Program to the High Five Award Program and President’s Award Program, we recognize professional achievement with a variety of rewards including points towards gift cards, merchandise, and travel experiences, as well as group RRSP/DPSP contributions and more.

Our Community Leadership Program recognizes employees who make a positive impact in their communities through volunteer work with a grant for their charity of choice. Additionally, we provide employees with one paid day off each year to volunteer at their favourite local charity.

The Perks (for eligible employees)

• Extended health and dental benefits
• Employee & Family Assistance Program
• Employer-Matched Group Retirement Savings Plan
• Employee Share Investment Plan
• Well-being initiatives including: a wellness account; virtual self-care programs and extended mental health benefits
• Employee corporate discount for GoodLife Fitness

HomeEquity Bank is committed to an inclusive, equitable and accessible workplace. Accommodations are available on request for candidates taking part in all aspects of the selection process. To request accommodation, please contact your recruiter. Please note that our successful candidate is required to complete a background check.

Stay in the Know Find out what we’re up to online, and learn more about what makes HomeEquity Bank a great place to work: LinkedIn Youtube Facebook Twitter Instagram Chip.ca

HomeEquity Bank is a Schedule 1 Canadian chartered bank and the leading national provider of reverse mortgages, with a growing portfolio. As the only bank solely dedicated to serving homeowners 55 and up, we’re passionate about helping Canadian homeowners live retirement on their terms. We live that commitment every day, with a range of reverse mortgage solutions that include our flagship CHIP Reverse Mortgage product.