Erick Da Silva

Most data-loss prevention happens after the fact — batch scans, nightly jobs, audits that find the leak days later. But sensitive data leaks in motion: an SSN typed into a free-text "notes" field rides a Kafka topic to a dozen downstream consumers within seconds. This session shows how we shifted DLP left, into the stream itself, so PII and PCI are detected and masked before a record ever lands in a downstream system — a pattern we took from lab to a real client engagement. We walk through a production-shaped pipeline: customer records flow into Confluent Cloud Kafka; Confluent Cloud for Apache Flink runs streaming SQL that calls a custom Java UDF; the UDF calls an external DLP API (Nightfall) to find SSNs, credit cards, and emails hidden in free text. High-confidence findings are masked inline (last four digits kept) and attached as a structured findings object; lower-confidence hits are routed to a separate review topic for a human analyst instead of being silently dropped or over-redacted. Per-call latency is tracked per record and aggregated per minute, so the cost of "scanning in the stream" is observable, not a black box. On technical depth, we cover calling an external API…