DLP & Data Exfiltration
Tracking sensitive data movement and high-risk departures across 45k identities
Executing hundreds of complex insider-risk investigations spanning proprietary IP theft, privileged user access abuse, policy violations, and sensitive data staging across enterprise endpoints.
Program Outcomes
Comprehensive DLP and UEBA departure risk modeling across all global corporate seats.
Complex cases resolved spanning IP theft, privileged access abuse, and high-risk departure exfiltration.
Continuous visibility across USB, personal cloud sync, browser uploads, print, and clipboard.
Defensible evidentiary packets enabling rapid cross-functional executive and legal action.
The Challenge
The High-Risk Departure Window
Empirical data demonstrates that over 85% of employee-initiated IP exfiltration occurs in the 30 to 90 days leading up to resignation notice. Detecting deliberate data hoarding, renaming of proprietary source files, and encrypted uploads without invading routine employee privacy is a critical balance.
Privileged Access Abuse
Engineers and administrators holding elevated permissions frequently bypass standard business workflows. Identifying when authorized credentials are used for unauthorized personal data collection requires deep behavioral context.
Engineering & Investigative Strategy
01. Multi-Vector Data Movement Telemetry
Deployed and tuned Proofpoint ITM and endpoint DLP sensors to track file lineage across USB storage, personal cloud synchronizers, browser upload forms, print queues, and clipboard actions.
02. Departure Risk Score Model
Integrated HR Workday signals (resignation submission, performance management plans, restructuring announcements) into Exabeam UEBA risk models to automatically increase behavioral telemetry sensitivity for high-risk accounts.
What I Shipped
Data Security Investigation Workbench
Engineered an integrated investigative workbench that reconstructs file movement history, hash provenance, and user intent in a single visual interface for rapid case disposition.
Standardized High-Risk Playbooks
Authored repeatable playbooks for executive VIP cases, privileged credential compromise, and emergency departure quarantines, ensuring legal compliance and evidentiary chain of custody.