Data Security Posture Management (DSPM) Lead – Manager

Grant Thornton Global Delivery Center Poland is an international company offering data security management roles in a hybrid work setting located in Poznań. The role involves collaboration with global teams across US, EU, and APAC regions, focusing on data security posture management across cloud, hybrid, and on-premise environments.

• Bachelor’s degree in Information Management, Library Science, Computer Science, Business Administration, or related field.
• 5+ years' experience in Data Management, Data/Information Governance, or Compliance within a digital environment.
• Deep understanding of DSPM concepts: data discovery, classification, lineage, access governance, risk scoring, remediation workflows.
• Experience with cloud security architecture across Azure, AWS, and SaaS platforms.
• Strong understanding of IAM controls, RBAC, Conditional Access, and data-level access models.
• Knowledge of encryption, masking, tokenization, and secure data handling practices.
• Strong familiarity with GDPR, HIPAA, SOX, ISO 27001, NIST frameworks, and global data protection laws.
• Ability to interpret regulatory requirements into technical and operational controls.
• Ability to analyze complex data landscapes and identify risks and remediation priorities.
• Strong communication skills for preparing executive-ready dashboards and reports.
• Ability to collaborate with cross-functional teams globally (US, EU, APAC).

Nice to have:

• 5+ years in Information Security, Data Governance, or Cloud Security programs.
• Experience in multinational environments with complex data architectures.
• Certifications: CISSP, CISM, CCSP, Azure Security Engineer, or equivalent.
• Prior experience deploying DSPM technologies or building governance frameworks.

Sensitive Data Discovery & Classification:

• Lead automated discovery of sensitive and regulated data across cloud platforms, SaaS, databases, and on-premise systems.
• Ensure classification and tagging of PII, PHI, financial, client, and regulated data based on policy and regulatory requirements.

Risk Assessment & Exposure Analysis:

• Continuously assess data exposure risks, excessive permissions, and misconfigurations across environments.
• Evaluate compliance alignment with ISO 27001, NIST 800-53, GDPR, HIPAA, SOX, and internal standards.

Data Security Controls & Remediation:

• Collaborate with Identity & Access Management to enforce least-privilege access and remove excessive permissions.
• Recommend and implement security controls such as encryption, masking, tokenization, and DLP policies.
• Work with platform and application teams to remediate identified data security gaps.

Monitoring & Reporting:

• Provide continuous monitoring of data access patterns, anomalies, and compliance posture across hybrid environments.
• Deliver automated reporting to Security, Compliance, IT Leadership, and audit stakeholders.
• Track and report metrics related to risk reduction, compliance, and overall data security posture.

Policy Alignment & Governance Collaboration:

• Ensure alignment between DSPM strategy and Data Lifecycle Management and Data Governance programs.
• Support development and enforcement of data-centric security policies, standards, and procedures.
• Work with Data Owners and Stewards to validate classification requirements and ensure ongoing data protection.

Tool & Technology Enablement:

• Partner with GTech and Enterprise Architecture to ensure integrations align with global DSPM frameworks and strategy.
• Experience with DSPM vendor solutions (e.g., Veronis, Proofpoint, Cyberhaven).

Cross-Functional Incident Response Support:

• Support escalations for data-related security incidents with Legal, Compliance, GTech, and Business units.
• Participate in investigations involving data leakage, unauthorized access, or policy violations.