Lead Security Engineer

L3 Data & Endpoint Security Engineer – Advanced Support & Architecture About DXC DXC helps global companies run their mission-critical systems and operations while modernizing IT, optimizing data architectures and ensuring security and scalability across public, private and hybrid clouds. The world’s largest companies and public sector organizations trust DXC to deploy services to drive new levels of performance, competitiveness, and customer experience across their IT estates. Our more than 125,000 people in 70-plus countries are entrusted by our customers to deliver transformative technologies to ensure the success, safety and well-being of businesses and people around the world. By combining strengths and expertise globally, we create solutions and deliver greater outcomes for customers across their entire IT estate. Learn more about how we deliver excellence for our customers and colleagues at dxc.com. About the Role The L3 Data & Endpoint Security Engineer owns the end-to-end design, hardening and incident response of every SAMA-mandated Data- and Endpoint-Security control across a broad technology stack spanning data protection, endpoint defense, threat and vulnerability management, and visibility/analytics platforms. This role serves as the final escalation point for complex security incidents, leads architecture reviews, and ensures evidence alignment with SAMA CSF domains PRV-03 (Data Security) and DE-02 (Endpoint Protection). In this position, you will design highly available clusters and pipelines, lead root-cause analysis for critical incidents, fine-tune policies across multiple platforms, and maintain compliance with regulatory frameworks. You will also play a key leadership role, mentoring L2 engineers, building run-books and simulations, and contributing to budget and roadmap planning for the security toolset. This is a high-visibility role requiring deep technical expertise and the ability to interface directly with auditors, regulators and senior leadership, ensuring the organization's data and endpoint security posture meets stringent regulatory and business requirements. Essential Job Functions Design highly-available DLP/DAM clusters, encryption key hierarchies and EDR telemetry pipelines Integrate all security platforms with SIEM (QRadar) and SOAR for automated response Lead P1/P2 incidents including data-loss breach, ransomware and insider misuse across the full tool set Perform deep packet and forensic analysis, and issue formal root-cause analysis reports with preventive actions Build and fine-tune ForcePoint DLP policies, Seclore rights templates, and Cortex detections to meet business and regulator SLAs Maintain classification and retention schemes per SAMA SecReg Map control operation to SAMA / NCA ECC evidence, prepare audit artefacts and lead regulator walkthroughs Conduct quarterly tool health and efficacy reviews, and drive remediation programmes Create run-books, tabletop exercises and lab simulations, and coach three L2 engineers Recommend budget and roadmap items including licensing, hardware and SaaS migration Basic Qualifications Bachelors in Cybersecurity, IT or related field 7+ years specialized in data-security or endpoint-protection, with hands-on experience in ≥70% of the listed tool stack Past ownership of enterprise-grade DLP rollout and EDR containment playbooks Strong scripting/automation skills (Python/PowerShell/REST) Proven experience presenting to auditors and senior leadership Other Qualifications CISSP, CISM, or GIAC (GCFA/GCED) Vendor certifications: ForcePoint DSSP, Imperva DSF, Trend Micro CPSE/XDR, Carbon Black PCED, Thales Certified Engineer, Tripwire TIPS ITIL v4, ISO 27001 Lead Auditor Show more Show less