WHO WE ARE

HomeEquity Bank is a Schedule 1 Canadian chartered bank and the leading national provider of reverse mortgages, with a growing portfolio. As the only bank solely dedicated to serving homeowners 55 and up, we’re passionate about helping Canadian homeowners live retirement on their terms. We live that commitment every day, with a range of reverse mortgage solutions that include our flagship CHIP Reverse Mortgage product.

OUR VALUES, OUR PASSION

At HomeEquity Bank, our values drive and inspire our actions with our customers, our partners and each other. Customer-Focused. Passionate Advocates Courage to Act. Do the Right Thing One Team. One Vision Think Long-Term. Ever-Evolving Be Exceptional. Inspire Greatness

POSITION SUMMARY

The Senior Specialist, Data Loss Prevention is the hands on technical authority behind our DLP and data security capability. The role is responsible for the configuration, tuning, and reporting of our data loss prevention and data security posture management platforms, and for designing the workflows that route and resolve data loss events. Accountability for the DLP program sits with the CISO. The successful candidate will bring the operational reality, the tooling expertise, and the risk evidence that inform roadmap and enforcement decisions, and will be a primary voice in setting direction.

MAJOR ELEMENTS OF THE ROLE

Key responsibilities of this role include:

- Program input and direction Serve as the principal technical advisor to the CISO on DLP strategy, tooling investment, and enforcement posture
- Recommend the roadmap and maturity plan, and build the risk based case behind each recommendation




- Working with the data governance teams to maintain and improve the data classification taxonomy and sensitivity labelling scheme
- Draft and maintain DLP standards and procedures for CISO approval, with the CISO as accountable policy owner
- Represent DLP capability in audits, regulatory reviews, and third party assessments as the technical subject matter expert
- Evaluate platforms and participate in vendor selection, proof of concept, and renewal decisions
- Surface capability gaps, coverage blind spots, and emerging data risks early enough to influence planning cycles
- Platform engineering and tuning
- Configure, tune, collaborate, and continuously improve detection policies across email, collaboration and file sharing platforms, endpoints, cloud applications, and network egress
- Configure, tune and advise on data discovery and classification tooling to build and maintain an inventory of sensitive data across cloud, SaaS, and on premise data stores
- Assist with the implementation of sensitivity labelling, automated classification, and associated protection controls where needed
- Reduce false positive volume through iterative rule refinement, exact data matching, document fingerprinting, machine learning classifiers, and context based conditions
- Manage policy lifecycle from simulation and pilot through to enforcement, under documented change control




- Integrate DLP telemetry into SIEM, SOAR, ITSM, and case management tooling
- Support insider risk and communication monitoring capabilities where in scope

- Workflow design

- Design triage, escalation, and investigation workflows for DLP alerts, including severity models and proposed service level targets
- Build the intake and exception process for business justified data movement, including approval paths and time bound exceptions
- Define the handoff model with the SOC, HR, Legal, Privacy, and Compliance for insider risk and confirmed data loss events
- Automate repetitive triage and enrichment steps to keep analyst effort focused on genuine risk

- Reporting and metrics

- Build and maintain operational dashboards and reporting on data risk, alert volumes, false positive rates, policy coverage, remediation timelines, and repeat offenders
- Prepare the DLP content the CISO takes to executive, risk committee, and board audiences, translating technical findings into business risk language
- Establish the metrics baseline and evidence measurable risk reduction over time

- Stakeholder engagement

- Partner with Privacy, Legal, HR, Data Governance, , and business data owners to validate what constitutes sensitive data and what enforcement is acceptable
- Deliver awareness content and targeted coaching for teams generating high alert volumes
- Support incident response as the DLP technical lead during suspected data exfiltration events

SKILLS AND EXPERIENCE REQUIRED

Qualifications

- 3 to 7 years in information security, with at least 2-3 years hands on with enterprise DLP or data security tooling

📌 Senior Specialist, Data Loss Prevention (Toronto)
🏢 HomeEquity Bank
📍 Toronto