About WGA Consulting
WGA Consulting is a global management consulting firm and a world-class alternative to the big-name consulting firms. We help senior leaders make and execute the decisions that matter most, across AI and digital transformation strategy, ESG, growth, culture, operations, and enterprise transformation. Our firm focuses on areas of senior management concern, creating enduring value and delivering measurable impact at the intersection of strategy, technology, and operating model design. WGA’s WGA Advisors AI Workforce Solutions practice is at the forefront of helping global enterprises move from isolated AI experimentation to scaled, business-led agentic AI deployment.
The Situation
WGA Advisors is delivering an AI Workforce program for an enterprise client preparing to move from AI experimentation to production AI Agents. A completed readiness diagnostic identified a set of data protection gaps that gate deployment:
- No enterprise data classification scheme exists, so data loss prevention has nothing to enforce against. Protection tooling is licensed but applied only to a narrow privacy data set.
- No output-level data loss prevention and no prompt-injection defenses are in place, so AI Agent outputs would flow unfiltered to downstream systems and users.
- No data owners, custodians, or stewards are named, so AI Agents have no sanctioned source of truth to read from and classification cannot start.
- Public large language model use is unrestricted, with consumer AI tools running at the device level rather than under tenant control.
- A significant volume of process data lives in spreadsheets and shared drives outside systems of record, unlabeled and unprotected.
- A major enterprise resource planning program is transforming the underlying data at the same time, so the foundation agents will read is still moving.
The client operates under national data protection law, and part of the estate is subject to sector regulation covering data localization, cross-border transfer, third-party processor duties, and accountability for automated decisions affecting consumers. Where personal data is processed is an open architecture question that classification work directly informs.
The Opportunity
WGA Advisors is engaging a Lead Consultant to design and stand up enterprise data classification and data loss prevention ahead of production AI Agent deployment. This is a hands-on advisory and delivery role: the consultant authors the classification scheme, policy, and handling standards, names and onboards the data ownership model, configures and tunes protection tooling alongside the client’s platform team, and extends both classification and loss prevention to cover what AI Agents may read, retain, and return.
Classification is the precondition for everything downstream. Loss prevention, agent grounding permissions, residency handling, and output filtering all enforce against labels that do not exist today. The consultant is accountable for producing those labels on a priority-domain-first sequence, measured in weeks for the first domains rather than as a multi-year estate-wide program, while leaving behind a scheme that scales to the full estate.
The role works alongside engagement leadership, the client’s cybersecurity and data governance functions, the enterprise resource planning program team, and the AI Agent build pods.
This is a temporary project-based engagement of 6 months, structured around scheme design, priority-domain classification, tooling enforcement, and transition to client ownership. Strong potential for extension based on performance and continued client demand across WGA’s pipeline.
Core Responsibilities
Classification scheme, policy, and standards
- Design the enterprise data classification scheme, including tier definitions, decision criteria, worked examples, and the handling matrix that governs storage, sharing, transfer, retention, and disposal at each tier
- Author the classification policy and supporting standards, and take them through client legal, risk, and executive review to ratification
- Map the scheme to applicable data protection obligations and sector requirements covering localization, cross-border transfer, and processor duties, working with client legal counsel
- Define the classification workflow at the point of creation, and the bulk remediation approach for legacy repositories, shared drives, and the spreadsheet estate that sits outside systems of record
Data ownership and stewardship operating model
- Design and stand up the data ownership operating model, naming data owners, custodians, and stewards by domain with documented decision rights and escalation paths
- Embed ownership assignment inside the enterprise resource planning release rather than beside it, so ownership travels with the master data work already underway
- Author the stewardship charter, onboarding materials, and operating cadence, and run the first cycles until the client can run them unaided
- Establish lineage and access permissioning expectations for the data domains AI Agents read from
Classification execution on the priority domains
- Sequence classification so the data domains consumed by the first AI Agent use cases are classified first, with a defined path to estate-wide coverage
- Run classification workshops with domain owners, resolve disputed classifications, and record decisions with rationale
- Build the label taxonomy in Microsoft Purview, configure manual and automatic labeling, and validate label application against sampled data
- Assess and specify the security licensing uplift required to reach the target labeling and protection capability
Data loss prevention design and enforcement
- Author data loss prevention policies that enforce against the new labels across endpoint, email, collaboration, and cloud application boundaries
- Design output-level data loss prevention for AI Agent responses, so generated content is filtered against sensitive data classes before it reaches users or downstream systems
- Design prompt-injection defenses for the agent fleet, including input handling rules, tested defense patterns, and a re-testing cadence
- Bring public large language model use under tenant control, with egress controls, sanctioned tooling, and user guidance replacing unrestricted device-level access
- Define the exception process, false-positive triage path, tuning cadence, and the telemetry needed to run all three
AI-specific data controls
- Define what an AI Agent may read, retain, and return by classification tier, and translate that into enforceable platform configuration
- Specify de-identification and masking at the boundary where personal data must not leave a defined processing environment, in support of the residency architecture decision
- Confirm that agent grounding and retrieval inherit user entitlements rather than bypassing them, and document the control that proves it
- Establish knowledge governance for the standard operating procedures and policy documents agents reason from, so a single authoritative version exists per topic
Measurement, advisement, and handover
- Define and report the control metric set, including priority-domain classification coverage, label application rates, loss prevention incident volumes, and false-positive rates
- Produce executive readouts, steering committee papers, and risk committee materials to tier-one consulting quality standards
- Author run books, policy documents, and training materials, and transition the scheme, tooling configuration, and operating model to client ownership with clean documentation
Qualifications
Education
- Bachelor’s degree required in a relevant discipline, including but not limited to Information Systems, Computer Science, Cybersecurity, Data Management, Law, or a closely related field
- Strong academic record from a recognized institution. Relevant certifications such as CISSP, CIPP, CIPM, CDMP, or Microsoft SC-400 Information Protection and Compliance Administrator are a plus
Experience
- 10 years of overall professional experience, including delivery with a tier-one consulting firm such as BCG, Accenture, or Deloitte
- Demonstrated end-to-end delivery of at least two enterprise data classification programs, taken from scheme design through to enforced protection in production
- Experience standing up data ownership and stewardship operating models in complex, multi-entity organizations
- Experience advising regulated clients on personal data protection obligations, including cross-border transfer and localization requirements
- Track record of client-facing delivery under structured acceptance criteria, change control, and tier-one consulting quality standards
Required expert skills
- Expert-level design of enterprise classification schemes, handling matrices, and the policies that make them enforceable
- Hands-on configuration of Microsoft Purview Information Protection and Microsoft Purview Data Loss Prevention, including label taxonomy, automatic labeling, policy authoring, simulation mode, and post-deployment tuning
- Designing data loss prevention for generative AI use cases, including output-level filtering, prompt-injection defense, and control of public large language model use at the tenant boundary
- Building and running data ownership models where owners, custodians, and stewards are named, onboarded, and held to a cadence
- Translating classification tiers into machine-enforceable access and retrieval rules for AI Agents
Technical fluency
- Strong command of the Microsoft 365 tenant, identity and access management, endpoint protection, and cloud access security controls
- Working knowledge of enterprise resource planning and cloud data platform data domains, including SAP S/4HANA data structures and lake or warehouse architectures, sufficient to classify at the domain level and specify enforcement
- Familiarity with data cataloging and lineage tooling, and with permissioning models that agents must inherit rather than bypass
- Familiarity with the agentic AI landscape, retrieval-grounded architectures, human-in-the-loop patterns, and enterprise large language model deployment considerations
Communication and execution
- Clear written and verbal communication, including the ability to take a classification decision to a business owner in plain language and to a risk committee in control language
- Proven ability to deliver on a pipelined schedule with iterative feedback, tight timelines, and high quality standards
- Demonstrated ownership, follow-through, and the ability to manage multiple workstreams concurrently across cybersecurity, data governance, and business functions
Engagement Details
- Hourly rate: $85 to $95 US dollars per hour
- Duration: 6 months
- Work location: Remote, with periodic on-site presence at the client site as required by the workshop, classification, and enforcement cadence
- Travel: Periodic travel to the client site as required by the delivery cadence
- Language: Professional written and spoken English required
- Authorization: Must be authorized to work in the consultant’s country of residence and able to travel internationally as required
WGA Consulting is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity or expression, national origin, disability, protected veteran status, or any other characteristic protected under federal, state, or local law, where applicable.
Pay: $85.00 – $95.00 per hour
Benefits:
- Flexible schedule
Experience:
- Data Classification and DLP: 5 years (Required)
Work Location: Remote