ANSR is hiring for one of its clients.
About American Airlines:
To Care for People on Life's Journey®. Together with our American Eagle regional partners, we offer thousands of flights daily to more than 350 destinations in more than 60 countries.
American Airlines is transforming the way it delivers technology to its customers and team members worldwide.
American’s Tech Hub in Hyderabad, India, is our latest technology office location and home to team members who drive technical innovation and engineer unrivalled digital products to best serve American’s customers and team members. With U.S. tech hubs in Dallas-Fort Worth, Texas and Phoenix, Arizona, our new team in Hyderabad, India enables better support of our 24/7 operation and positions American to deliver industry-leading technology solutions that create a world-class customer experience.
INTRO:
Are you ready to explore a world of possibilities, both at work and during your time off Join our American Airlines family, and you’ll travel the world, grow your expertise, and become the best version of you. As you embark on a new journey, you’ll tackle challenges with flexibility and grace, learning new skills and advancing your career while having the time of your life. Feel free to enrich both your personal and work life and hop onboard!
WHY YOU’LL LOVE THIS JOB:
As one diverse, high performing team committed to technical excellence, you’ll help shape the modern cybersecurity capabilities that drive a more reliable, safe, and profitable airline. The Cybersecurity Technology Services product group delivers comprehensive solutions, processes, and platforms that embed and monitor security across Cloud, Application, Endpoint / End User, Data, and AI domains. In this portfolio, you’ll help strengthen the safeguards that protect our systems, data, and people through consistent, scalable practices and deliver solutions that secure one of the world’s most complex global operations.
The Sr. Engineer - Data Protection plays a key role in delivering, engineering, and enhancing American Airlines’ data protection and privacy technology capabilities. In this role, you’ll design, build, and support core components of our data protection ecosystem including data security engineering and protection, privacy engineering and assurance, data discovery and classification, retention/ROT data minimization, and access governance. You’ll work closely with Cybersecurity, Privacy Office, Enterprise Data, Legal, and product and platform teams to implement scalable, modern controls that safeguard American Airlines’ critical information assets and enable secure, innovative business solutions. As a hands-on engineer, you will solve complex data protection challenges, automate controls, and contribute to the continuous improvement of our enterprise privacy and data protection program.
This list is intended to reflect the current job but there may be additional essential functions (and certainly non-essential job functions) that are not referenced. Management will modify the job or require other tasks be performed whenever it is deemed appropriate to do so, observing, of course, any legal obligations including any collective bargaining obligations.
- Operationalize automated data discovery, classification, and inventory; apply sensitivity labels and consistent taxonomy across data stores, pipelines, and collaboration systems.
- Engineer DSPM capabilities with tools (e.g., Securiti, BigID) to surface data posture risks (overexposure, shadow data, stale sensitive data) and drive remediation workflows.
- Implement and support encryption, tokenization, masking, anonymization/pseudonymization for data at rest and in transit; integrate with cloud key management systems and enforce approved cryptographic standards; define crypto baselines and policy-as-code guardrails.
- Configure and govern access controls with RBAC/ABAC and purpose-based authorization; perform least-privilege and fine-grained access reviews across data platforms.
- Deploy, tune, and operate DLP and DAM solutions (e.g., Microsoft Purview DLP, Imperva/Guardium); build detections for PII/PCI/PHI and reduce false positives with policy and context improvements.
- Integrate and tune UEBA and Insider Risk signals to detect anomalous data access and exfiltration, partner on response workflows and preventive control changes.
- Integrate data protection telemetry with SIEM/SOAR; build detections, correlation rules, and automated response playbooks for data-related threats and policy violations.
- Implement data minimization and retention/ROT enforcement patterns; automate monitoring of lifecycle actions (archive, delete, redact) aligned to policy and legal holds.
- Implement DSAR (data subject access request) orchestration and fulfillment with SLA monitoring; automate data collection, redaction, and secure delivery with audit trails.
- Contribute to cookie/tag governance and catalog assurance; validate consent signals, storage durations, and vendor script behavior against policy.
- Support privacy platform capabilities and integrate with identity, ticketing, data catalogs/lineage, and evidence repositories.
- Embed data protection and privacy-by-design controls into services and CI/CD (pre-commit/CI privacy code scanning, secret scanning, schema checks for sensitive fields, data egress policies).
- Produce compliance evidence and reports for GDPR/CCPA/CPRA, PCI DSS, HIPAA, and internal audits; maintain controls health dashboards, regulatory tracking, and program KPIs.
- Investigate data-related incidents and privacy events in partnership with IR/SOC/Privacy Office. Collect artifacts, support forensics, document findings, and drive preventive engineering fixes.
- Conduct platform hardening and vulnerability remediation for data control tooling (misconfigurations, exposed buckets, weak crypto, excessive permissions).
- Participate in red teaming/tabletop exercises for data scenarios (insider misuse, public link exposures, unintended AI training data); translate findings into control improvements.
- Partner with Cybersecurity, Privacy Office, Enterprise Data, Legal, and product/platform teams to align designs and deliver privacy- and data protection-by-design outcomes.
ALL YOU’LL NEED FOR SUCCESS:
Minimum Qualifications- Education & Prior Job Experience:
- Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, or a related field (or equivalent practical experience)
- 3+ years of progressive experience in data protection, privacy engineering, security engineering, or platform engineering roles.
- Hands on experience implementing and operating data protection capabilities such as encryption at rest and in transit, cloud key management, data classification, DLP, DAM, or DSPM platforms.
- Strong understanding of identity and access control patterns (RBAC/ABAC, least privilege access, access reviews) and secure data handling practices including classification, labeling, and retention/ROT.
- Experience using scripting or automation (e.g., Python, PowerShell) and working with APIs, logs, and CI/CD pipelines to integrate, operate, or enhance security controls.
- Ability to analyze security signals and alerts, follow and improve runbooks, document findings clearly, and collaborate with cross functional teams to implement remediation and continuous improvements.
Preferred Qualifications- Education & Prior Job Experience:
- Master’s degree in Computer Science, Cybersecurity, Engineering, Information Assurance, or a related technical field.
- Experience with Microsoft Purview (Information Protection & DLP), Securiti.ai, BigID, OneTrust, and DAM (Imperva/Guardium).
- Exposure to Azure, AWS, or GCP security services and cloud data platforms (e.g., storage, databases, messaging/streaming).
- Experience with Git/GitHub, GitHub Actions/Azure DevOps, secrets scanning, and code scanning tools.
- Familiarity with SQL, regex, and data transformation basics (e.g., dbt, Spark, ETL) for building detections and data handling checks.
Skills, Licenses & Certifications:
- Programming / Scripting: Python, PowerShell (nice to have: Bash); strong facility with REST/JSON, YAML, and regex; specific to Privacy Portal - Java, Springboot, Angular/React.
- Data / Querying: SQL (and exposure to data pipelines—dbt/Spark/ETL concepts helpful).
- CI/CD & DevOps: Git/GitHub, GitHub Actions or Azure DevOps; artifact/versioning; secret scanning; pre-commit hooks; policy checks in pipelines.
- Infrastructure / Policy as Code: Terraform or Bicep; OPA/Rego or equivalent for policy-as-code preferred.
- Cloud & Crypto: Azure/AWS/GCP basics; Azure Key Vault, AWS KMS, GCP KMS; TLS/mTLS; tokenization; HSM fundamentals.
- Identity & Access: Microsoft Entra ID (Azure AD), Okta; RBAC/ABAC; JIT/PAM concepts; purpose-based authorization patterns.
- Data Protection Platforms: Microsoft Purview (Information Protection & DLP), Securiti.ai, BigID, OneTrust (consent/DSAR), Imperva or IBM Guardium (DAM).
- Monitoring & Response: SIEM (Microsoft Sentinel, Splunk), SOAR (Logic Apps, Splunk SOAR), ITSM/ticketing (ServiceNow/Jira); building detections and playbooks.
- Insider Risk / UEBA & Collaboration: Microsoft Insider Risk, M365 collaboration safeguards (external sharing governance, link expiration, watermarking).
- Web/App Privacy: CMP/consent signals, cookie/tag governance, data egress controls, redaction/watermarking where applicable.
- Clear, well-structured documentation of engineering patterns, runbooks, and technical decisions.
- Strong analytical and problem-solving skills with the ability to translate requirements into maintainable controls, automations, and repeatable engineering patterns.
- Privacy and security certifications such as CIPT, CDPSE, CIPP/US, CIPP/E, Security+, CCSP, or CISSP (CISSP relevant for Sr. Engineer).
- Cloud certifications for Azure, AWS, or GCP at the associate or professional level.