Insider Threat DLP Engineer (L1)

About Us

WTW is a leading advisory, broking, and solutions company with a storied history dating back to 1828. From the Titanic in 1912 to supporting the Moon Buggy in 1971, we have a legacy of turning risk into growth opportunities. 

Our Lisbon Regional Delivery Hub is at the heart of this innovation, with a vibrant team of 300+ professionals dedicated to excellence every day.

The Opportunity

We’re looking for passionate professionals to join our Cyber Security team and provide trusted expertise across WTW. Right now, we have an exciting opportunity for an experienced Insider Threat Engineer to play a key role in our Cyber Defense department.

In this role, you'll be part of the Insider Threat Engineering team, focusing on Data Loss Prevention (DLP). Our team is diverse—both geographically and culturally—working together to ensure the smooth operation of our DLP platform.

As an L1 Insider Threat Engineer (DLP), you’ll report to the L3 Insider Threat Engineering Lead (DLP) and be instrumental in strengthening WTW’s data protection strategy. If you have a strong troubleshooting background and technical expertise in the Microsoft Security stack, particularly Purview DLP, this could be the perfect role for you.

Primary Responsibilities

• Troubleshoot & support DLP technologies, policies, and rules.
• Monitor system health and conduct daily volume checks on the DLP platform.
• Act as the triage point for cases escalated to Microsoft.
• Analyze logs and provide insights to improve DLP performance.
• Refine and fine-tune existing DLP rules for maximum efficiency.
• Collaborate with Insider Threat Analyst teams as needed.
• Conduct regular assessments to identify areas for continuous improvement.
• Report on performance & effectiveness of DLP technologies.
• Identify trends & suggest improvements for DLP policies.
• Stay ahead of emerging DLP technologies and industry trends.

Secondary Responsibilities

• Contribute to projects that enhance insider threat and data protection policies.
• Support additional tasks as designated by leadership.

What We’re Looking For

Must-Have Skills

• Experience troubleshooting and administering DLP technologies in a global enterprise.
• Strong engineering expertise in Microsoft Security Stack, including Purview DLP, IRM, and Defender.
• Relevant Microsoft certifications in these technologies.
• Knowledge of data protection laws (e.g., GDPR, CCPA, HIPAA).
• Strong analytical and problem-solving skills.
• Excellent communication and interpersonal skills, with the ability to engage stakeholders at all levels.
• Self-motivated with the ability to work independently.

Nice-to-Have Skills

• Experience troubleshooting Microsoft Insider Risk Management in a global setting.
• Hands-on experience with KQL and PowerShell.
• Industry certifications such as CISSP, CISM, or CIPP.

What’s in it for you?

At WTW, you’ll join a motivating and dynamic team in an exciting, fast-growing European capital. Here’s what we offer:

🌍 Hybrid & flexible working – Choose between working from home or the office with flexible hours.

💰 Competitive salary – Attractive, performance-based remuneration.

🌟 Global exposure – Work with international clients in a world-renowned consultancy.

📈 Career growth – Fast-track your development with hands-on experience, on-the-job learning, and specialized training.

🤝 Collaborative culture – Work in a collegial, dynamic, and supportive team environment.

🎉 Team & corporate events – Celebrate successes and foster a strong community.

Willis Towers Watson is an equal opportunity employer