Senior Analyst, Data Protection

The Team

We are seeking a Data Protection Senior Analyst to join American Tower's Information Security - Governance, Risk and Compliance (GRC) Team. The Information Security- GRC team is responsible for oversight and management of multiple programs and policies to mitigate risk and enforce compliance of cyber security controls. Day to day, you will focus on the execution of the Data Protection Program at American Tower. The Data Protection Program is inclusive of the Data Loss Prevention (DLP) Program, as well as Data Classification, Rights Management and other data protection policies, controls and initiatives. As a Data Protection Sr. Analyst, you will partner cross-functionally to design, implement, and manage effective data loss prevention and data protection policies, processes, and technology solutions for data in motion, at rest, and in use. You will work closely with the Information Security Cyber Operations Team, Information Technology, Legal/Privacy and other business stakeholders to drive data protection objectives.

American Tower is a global digital infrastructure company serving customers through tower sites and other real estate solutions that support connectivity and opportunity, focused on achieving our vision of Building a More Connected World. Our success is rooted in the potential of our people and the power of local teams at our offices and sites across 25 countries.

We are one of the largest global Real Estate Investment Trusts (REITs) and a publicly traded (NYSE:AMT), Fortune 500 Company headquartered in Boston, Massachusetts. The next decade will be an exciting time as we evolve our infrastructure to meet tomorrow's needs and position our people to elevate their impact, their potential, and our shared success. Come grow your career with us!

For more information about how American Tower is building a more connected world, visit americantower.com

American Tower is proud to be an equal opportunity employer and will not discriminate against an applicant or employee based on age, sex, sexual orientation, gender identity, race, color, creed, religion, national origin or ancestry, citizenship, marital status, familial status, disability, military or veteran status, genetic information, pregnancy, reproductive decisions, or any other characteristic protected under applicable law.

American Tower is committed to fair and equitable compensation practices. Placement within the salary range is based on a variety of factors, including relevant experience, skills, certifications, job level, and location. For U.S.-based candidates only, please see the base salary range for this position listed below. This position is also eligible for annual bonus, and annual equity award and participation in the Employee Stock Purchase Plan (ESPP). For candidates outside of the U.S., salary and benefits are based upon local market practice.

American Tower also offers a comprehensive benefits package, which includes healthcare coverage, a 401(k) savings plan, paid time off, company holidays, sick leave, parental leave, and access to an Employee Assistance Program focused on mental and financial wellness, please click here to learn more.

What You Need to Succeed

• Bachelor's degree (or equivalent work experience) in Information Security, Cybersecurity, Computer Science, Information Technology, Information Systems, Business Administration, Legal/Privacy, and/or related field required.
• 6+ years of experience in Information Security with a focus on Data Loss Prevention, Data Classification, Data Protection, or Information Protection required.
• CISSP, CISM, CIPP, Microsoft Security certification, or equivalent certifications preferred.
• Hands-on experience with DLP and Data Classification Technologies such as Microsoft Purview Information Protection, Microsoft Purview DLP, Endpoint DLP, Network/Web DLP platforms, Cloud Access Security Broker (CASB), Defender for Cloud Apps and Microsoft 365 security technologies required.
• Experience designing, testing, implementing, managing and optimizing enterprise DLP, data classification and sensitivity labeling policies and controls into Data Protection/DLP technology platforms required.
• Experience analyzing DLP incidents and data loss use cases, as well as developing policies and mitigation strategies required.
• Experience working with engineering teams to implement and optimize DLP, data classification, and data protection controls required.
• Experience with enterprise-scale technology rollouts and change management initiatives in a global environment required.
• Strong understanding of data security, regulatory compliance, privacy requirements, and information governance required.
• Strong written and oral communication skills, including the ability to present ideas and suggestions clearly and effectively.
• Ability to work with different functional groups and levels of employees to effectively and professionally achieve results.
• Strong organizational skills; ability to accomplish multiple tasks within the established timeframes through effective prioritization of duties and functions in a fast-paced environment.

What You Can Offer Us

• Design, implement, and maintain DLP policies across DLP Technologies for endpoints, email, network/web, cloud applications, collaboration platforms, and data repositories.
• Conduct regular policy tuning and rule optimization to reduce false positives and improve detection accuracy.
• Lead testing, validation, and deployment of new DLP controls and policy updates.
• Manage DLP incident workflows, escalations, and exception processes.
• Identify emerging data protection risks and implement proactive monitoring controls.
• Coordinate rollout of sensitivity labels and rights management/encryption controls across Microsoft 365 and integrated business applications through testing, documentation, communications and end user training.
• Monitor label adoption, effectiveness, and compliance with corporate data handling requirements.
• Merge DLP policies with sensitivity label controls.
• Collaborate with data owners and business units to identify, classify, and protect sensitive information assets.
• Support the Program Manager in the development and execution of program strategy, key metrics and continuous improvement initiatives.
• Support internal and external audits by providing evidence of DLP controls, monitoring activities, and compliance reporting.
• Maintain documentation related to DLP policies, exceptions, configurations, and operational procedures.
• Serve as the subject matter expert (SME) for DLP, data classification, and information protection technologies.
• Provide guidance and training to business users, data owners, and IT teams on data protection best practices.
• Other duties as assigned.

What You Can Offer Us

• Design, implement, and maintain DLP policies across DLP Technologies for endpoints, email, network/web, cloud applications, collaboration platforms, and data repositories.
• Conduct regular policy tuning and rule optimization to reduce false positives and improve detection accuracy.
• Lead testing, validation, and deployment of new DLP controls and policy updates.
• Manage DLP incident workflows, escalations, and exception processes.
• Identify emerging data protection risks and implement proactive monitoring controls.
• Coordinate rollout of sensitivity labels and rights management/encryption controls across Microsoft 365 and integrated business applications through testing, documentation, communications and end user training.
• Monitor label adoption, effectiveness, and compliance with corporate data handling requirements.
• Merge DLP policies with sensitivity label controls.
• Collaborate with data owners and business units to identify, classify, and protect sensitive information assets.
• Support the Program Manager in the development and execution of program strategy, key metrics and continuous improvement initiatives.
• Support internal and external audits by providing evidence of DLP controls, monitoring activities, and compliance reporting.
• Maintain documentation related to DLP policies, exceptions, configurations, and operational procedures.
• Serve as the subject matter expert (SME) for DLP, data classification, and information protection technologies.
• Provide guidance and training to business users, data owners, and IT teams on data protection best practices.
• Other duties as assigned.