Data Security Architect

We are Generac, a leading energy technology company committed to powering a smarter world.

Over the 60 plus years of Generac’s history, we’ve been dedicated to energy innovation. From creating the home standby generator market category, to our current evolution into an energy technology solutions company, we continue to push new boundaries.

Major Responsibilities

Architecture & Roadmap:

• Develop and maintain the enterprise data protection reference architecture and multi-year roadmap covering labeling/classification, DLP, insider risk, encryption, tokenization, secure collaboration, and data discovery.

Microsoft Purview Architecture:

• Lead architecture, design, and configuration of Purview Information Protection (sensitivity labels, auto-labeling), Endpoint/Exchange/SharePoint/Teams/OneDrive DLP, Insider Risk, eDiscovery, and Records/Retention.
• Establish policy hierarchies, tuning standards, and exception processes.

Multi-Vendor DLP & DSPM:

• Evaluate, integrate, and/or rationalize additional data security controls (endpoint, network, CASB/SSE, DSPM) for non-Microsoft workloads and high-risk use cases — including platforms such as Varonis, Zscaler, and Cyera. Define control objectives, prevention vs. monitor modes, and rollout sequencing.
• Lead technical evaluations, proof-of-concept design, and success criteria for candidate platforms, and design the integration pattern between DSPM discovery and classification outputs and downstream Purview labeling and DLP enforcement.

Enterprise Platform Security Architecture:

• Design, document, and review data security controls for Generac’s key enterprise platforms, including Salesforce, SAP and SAP HANA, Databricks (including Unity Catalog), Windchill, Workday, and other business-critical SaaS, PaaS, and on-premises systems.
• Define standard control patterns for access and entitlement models, encryption at rest and in transit, tokenization and masking, logging and monitoring, and data movement between source systems, the enterprise data platform, and downstream analytics, reporting, and AI workloads.
• Apply heightened controls to sensitive worker, HR, and payroll data resident in Workday and its downstream integrations.
• Serve as the data security architect on platform and integration projects, providing requirements and architectural sign-off through the data security review process.

API & Integration Data Security:

• Define and maintain the security architecture for APIs, middleware, and data integration pipelines that move sensitive data between enterprise platforms, partners, and third parties.
• Establish standards for API authentication and authorization (OAuth 2.0, mutual TLS, signed tokens, service principals), least-privilege scope design, secrets and key management, rate limiting and throttling, payload minimization, field-level masking and tokenization, and encryption in transit. Partner with Integration and Data Engineering teams to review API and pipeline designs for exposure of regulated or sensitive data, define logging and monitoring requirements for API traffic to support detection and investigation, and maintain an inventory of integrations that carry sensitive data along with their control posture.
• Assess third-party and vendor API connections as part of the data security review process.

Data Lifecycle Governance:

• Partner with Data Governance to map critical data elements, owners, systems, and flows.
• Align labeling and retention schedules to regulatory and contractual obligations.

Secure Collaboration & External Sharing:

• Design patterns for secure B2B/B2C collaboration, guest access, and conditional sharing with watermarking, encryption, and expiration.

Detection, Response, and Tuning:

• Define incident workflows for DLP and insider risk alerts.
• Calibrate rules to reduce false positives; implement KPIs and dashboards to measure efficacy and user friction.

Engineering & Automation:

• Partner with M365/Azure engineering to implement at scale.
• Use scripting and APIs (PowerShell/Graph) to automate policy deployment, configuration drift detection, and evidence collection.

Standards & Patterns:

• Author and maintain security standards, reference patterns, and decision records.
• Review projects for adherence; provide architectural sign-off.

Risk & Compliance Alignment:

• Translate regulatory and internal control requirements into technical policies; support audits and eDiscovery requests with defensible, repeatable processes.

Change Management & Training:

• Create enablement materials for admins and end users; lead pilots, UAT, and phased rollouts.
• Engage champions to improve adoption and reduce business disruption.

Continuous Improvement

• rive backlog of enhancements.
• Benchmark against peers and industry frameworks.
• Track product releases and threat trends

Minimum Job Requirements

Education: 

• Bachelor’s degree in Information Security, Computer Science, Information Systems, Data Science or related field; or equivalent experience.

Certification/Licenses

Work Experience: 

• 7 years in Cybersecurity or IT or combination of 5 years experience and relevant certification Microsoft SC-400 (Information Protection), SC-100/SC-200; CISSP, CIPT or CDPSE

• 3 years of hands-on experience in Microsoft Purview / Information Protection / DLP, DSPM, or other enterprise data security platforms.
• Experience designing incident workflows, reporting, and KPI dashboards for DLP/insider risk.
• Hands-on experience with at least one additional DLP/SSE/CASB, DSPM, or endpoint DLP platform (Varonis, Zscaler, Cyera, Symantec/Broadcom, CS Falcon, Forcepoint, Netskope, Skyhigh/Trellix, Proofpoint, Microsoft Defender for Endpoint DLP), including evaluation, proof-of-concept, and integration with a native Microsoft data protection stack.

Knowledge/Skills/Abilities: 

• Expertise with Microsoft Purview: sensitivity labels/auto-labeling, Endpoint/M365 DLP, Insider Risk, eDiscovery, Records/Retention.
• Demonstrated data security architecture skills, including the ability to diagram complex data flows, develop technical requirements, author architecture specifications, and create clear visual and written documentation for both technical and non-technical audiences.
• Hands-on experience with at least one additional DLP/SSE/CASB, DSPM, or endpoint DLP platform (Varonis, Zscaler, Cyera, Symantec/Broadcom, CS Falcon, Forcepoint, Netskope, Skyhigh/Trellix, Proofpoint, Microsoft Defender for Endpoint DLP), including evaluation, proof-of-concept, and integration with a native Microsoft data protection stack.
• Strong understanding of data classification, encryption/IRM, data discovery, and data lifecycle management across M365, SaaS, IaaS, and on-premises file and database environments.
• Solid grasp of identity-centric and zero-trust concepts (Conditional Access, device compliance, least privilege).
• Demonstrated ability to architect and review data security controls for major enterprise business platforms such as Salesforce, SAP / SAP HANA, Databricks, Windchill, Workday, or comparable ERP, CRM, PLM, HCM, and data lakehouse systems — including access and entitlement models, encryption, logging, and controls governing data movement into analytics and AI workloads.
• Working knowledge of API and integration security, including authentication and authorization patterns (OAuth 2.0, mutual TLS, service principals), least-privilege scope design, secrets and key management, payload minimization, field-level masking or tokenization, and logging and monitoring of API traffic carrying sensitive data.
• Proficiency with PowerShell and Microsoft Graph; comfort with APIs and automation for policy management.
• Ability to collaborate with Legal/Privacy/Compliance and translate policy into technical control.
• Excellent verbal/written communication; ability to present architecture and tradeoffs to technical and executive stakeholders.