Data Security Specialist
Milbank LLP, a leading international law firm, is seeking a Data Security Specialist to join its Information Technology team in New York City. This role is integral to safeguarding the firm's data assets across both cloud and on-premises environments, ensuring the confidentiality, integrity, and availability of sensitive client, legal, and corporate information. The Data Security Specialist will be instrumental in developing and implementing controls to protect against unauthorized access, loss, and exfiltration, with a particular focus on emerging risks associated with generative AI and large language model (LLM) usage.
In this position, the Data Security Specialist will be responsible for designing and operating data loss prevention (DLP) policies across various platforms, including email, endpoints, and cloud services such as Microsoft Purview, M365, and Azure. The role involves implementing and tuning data classification, labeling, and encryption frameworks in alignment with firm policies and regulatory requirements. Additionally, the specialist will manage rights management solutions, tokenization, and key management systems. A critical aspect of the role is to design and enforce AI data leakage prevention controls, governing the use of sensitive data with tools like Microsoft 365 Copilot and ChatGPT Enterprise, including monitoring prompts and responses, enforcing sensitivity labels, and blocking unauthorized AI services.
The Data Security Specialist will also be tasked with investigating data security incidents, performing root-cause analyses, and leading containment and remediation efforts. Monitoring security information and event management (SIEM) systems, cloud access security brokers (CASB), and DLP alerts will be essential, along with triaging events and escalating them according to the incident response plan. Collaboration with the Security Operations Center (SOC) and forensics teams on insider threat and exfiltration investigations is expected. The role includes detecting and responding to AI-related data exposure events, such as sensitive data submitted to public LLMs, prompt injection, and unauthorized AI usage. Supporting compliance with regulations like GDPR, CCPA, NYDFS Part 500, SOC 2, and client security obligations is also a key responsibility. Conducting data risk assessments for new applications, vendors, and AI/LLM use cases, maintaining evidence for audits, and contributing to the firm's AI governance program are integral parts of the role.
Candidates should possess a bachelor's degree in computer science, Information Security, or a related field, or have equivalent experience. A minimum of four years in information security, with at least two years focused on data protection, DLP, or data governance, is required. Hands-on experience with enterprise DLP and rights management platforms, particularly within the Microsoft M365 ecosystem—including Microsoft Purview DLP, Microsoft Purview Information Protection, Azure Information Protection, and Azure Rights Management Services—is essential. Experience in tuning policies, authoring custom sensitive information types, and integrating Purview with Defender for Cloud Apps is necessary. Demonstrated expertise in AI data leakage prevention, including protecting sensitive data from exposure to generative AI and LLM services, is crucial. Familiarity with third-party DLP/IRM tools such as Symantec/Broadcom DLP, Forcepoint, Netskope, Zscaler, and Digital Guardian is advantageous.
The anticipated base salary range for this role is between $140,000 and $160,000, reflecting the firm's commitment to offering competitive compensation. Actual compensation will be determined based on factors including the candidate's relevant experience, qualifications, and the firm's needs. Milbank offers a comprehensive benefits package, including health and welfare benefits, work-life policies, and professional development opportunities. The firm is dedicated to fostering a welcoming and vibrant workplace that celebrates community and connection, supporting a high-performance culture that benefits clients, colleagues, and the communities served.
Milbank is committed to providing a collaborative and inclusive environment where employees can thrive. The firm invests in its people through ongoing training and development, including programs like Milbank@Harvard, which offers best-in-class training on finance, leadership, strategy, and management with Harvard faculty. Milbank's culture emphasizes teamwork, mutual respect, and a dedication to excellence, making it an ideal place for professionals seeking to make a significant impact in the field of data security.