Senior Specialist, Data Loss Prevention

WHO WE ARE

HomeEquity Bank is a Schedule 1 Canadian chartered bank and the leading national provider of reverse mortgages, with a growing portfolio. As the only bank solely dedicated to serving homeowners 55 and up, we’re passionate about helping Canadian homeowners live retirement on their terms. We live that commitment every day, with a range of reverse mortgage solutions that include our flagship CHIP Reverse Mortgage™ product.

OUR VALUES, OUR PASSION

At HomeEquity Bank, our values drive and inspire our actions with our customers, our partners and each other.

• •Customer-Focused. Passionate Advocates
• •Courage to Act. Do the Right Thing
• •One Team. One Vision
• •Think Long-Term. Ever-Evolving
• •Be Exceptional. Inspire Greatness

POSITION SUMMARY

The Senior Specialist, Data Loss Prevention is the hands on technical authority behind our DLP and data security capability. The role is responsible for the configuration, tuning, and reporting of our data loss prevention and data security posture management platforms, and for designing the workflows that route and resolve data loss events. Accountability for the DLP program sits with the CISO.

The successful candidate will bring the operational reality, the tooling expertise, and the risk evidence that inform roadmap and enforcement decisions, and will be a primary voice in setting direction.

MAJOR ELEMENTS OF THE ROLE

Key responsibilities of this role include:

Program input and direction

Serve as the principal technical advisor to the CISO on DLP strategy, tooling investment, and enforcement posture

Recommend the roadmap and maturity plan, and build the risk based case behind each recommendation

Working with the data governance teams to maintain and improve the data classification taxonomy and sensitivity labelling scheme

Draft and maintain DLP standards and procedures for CISO approval, with the CISO as accountable policy owner

Represent DLP capability in audits, regulatory reviews, and third party assessments as the technical subject matter expert

Evaluate platforms and participate in vendor selection, proof of concept, and renewal decisions

Surface capability gaps, coverage blind spots, and emerging data risks early enough to influence planning cycles

Platform engineering and tuning

Configure, tune, collaborate, and continuously improve detection policies across email, collaboration and file sharing platforms, endpoints, cloud applications, and network egress

Configure, tune and advise on data discovery and classification tooling to build and maintain an inventory of sensitive data across cloud, SaaS, and on premise data stores

Assist with the implementation of sensitivity labelling, automated classification, and associated protection controls where needed

Reduce false positive volume through iterative rule refinement, exact data matching, document fingerprinting, machine learning classifiers, and context based conditions

Manage policy lifecycle from simulation and pilot through to enforcement, under documented change control

Integrate DLP telemetry into SIEM, SOAR, ITSM, and case management tooling

Support insider risk and communication monitoring capabilities where in scope

Workflow design

Design triage, escalation, and investigation workflows for DLP alerts, including severity models and proposed service level targets

Build the intake and exception process for business justified data movement, including approval paths and time bound exceptions

Define the handoff model with the SOC, HR, Legal, Privacy, and Compliance for insider risk and confirmed data loss events

Automate repetitive triage and enrichment steps to keep analyst effort focused on genuine risk

Reporting and metrics

Build and maintain operational dashboards and reporting on data risk, alert volumes, false positive rates, policy coverage, remediation timelines, and repeat offenders

Prepare the DLP content the CISO takes to executive, risk committee, and board audiences, translating technical findings into business risk language

Establish the metrics baseline and evidence measurable risk reduction over time

Stakeholder engagement

Partner with Privacy, Legal, HR, Data Governance, , and business data owners to validate what constitutes sensitive data and what enforcement is acceptable

Deliver awareness content and targeted coaching for teams generating high alert volumes

Support incident response as the DLP technical lead during suspected data exfiltration events

SKILLS AND EXPERIENCE REQUIRED

Qualifications

3 to 7 years in information security, with at least 2-3 years hands on with enterprise DLP or data security tooling

Deep hands on experience administering at least one enterprise DLP platform, including policy authoring, endpoint agent deployment, and enforcement tuning

Experience with data discovery, classification, or data security posture management tooling, and the ability to ramp quickly on an unfamiliar platform

Proven track record tuning a DLP deployment from noisy to trusted, with evidence of the outcome

Strong working knowledge of enterprise identity and collaboration platform administration

Practical understanding of data classification, encryption, rights management, and cloud access security broker concepts

Experience designing security workflows and writing the documentation to support them

Familiarity with privacy and financial services regulatory drivers: PIPEDA, provincial privacy legislation, OSFI B-13, and PCI DSS where applicable

Technical Skills

DLP policy engineering across email, endpoint, cloud, and network control points

Query languages for interrogating security and audit data

Scripting and automation for administration, integration, and reporting

API integration between security platforms

Data visualization and business intelligence reporting

Logging, detection, and alert pipelines within an enterprise SIEM

Working knowledge of at least one major cloud provider’s data storage and security services

Understanding of data stores in scope for discovery: relational and NoSQL databases, object storage, file shares, and SaaS repositories

Preferred

Experience in banking, insurance, or another regulated financial services environment

Experience migrating or consolidating between DLP platforms

Exposure to insider risk investigations conducted alongside HR and Legal

Certifications such as CISSP, CIPP/C, CCSP, or vendor certifications in a major DLP or data security platform

Experience with GenAI data leakage controls and shadow AI discovery

WORKING CONDITIONS UNIQUE TO JOB

Hybrid work environment

WHY WORK AT HOMEEQUITY BANK?

Great Environment

HomeEquity Bank offers a hybrid working environment supported with a culture of flexibility – an approach that is unique to each person, and that enables both business and individual needs to be met in a mutually beneficial way.

We pride ourselves in recognizing and celebrating performance, community service, teamwork, and diversity among our employees.

A Dynamic Culture – With People at the Centre

We believe our people make all the difference; our tireless commitment to inclusivity, professional development, and employee experience has been recognized through awards including the Greater Toronto’s Top Employers 2024,Waterstone Canada's Most Admired Corporate Cultures 2022-2023, the Globe and Mail's Report on Business: Canada's Top Growing Companies 2022 (third year since 2019), Canadian's Mortgage Professional (CMP) Top Mortgage Employer 2023 for the third year in a row and Achievers Top 50 Most Engaged Workplaces 2023.

• Growth and Opportunities
• We provide challenging and rewarding careers in a wide variety of fields. We continuously develop and train our employees through professional growth opportunities and on-the-job training. We also encourage our employees to develop professionally and personally though a series of ca