Data Loss Prevention Analyst II

This role is responsible for supporting the organization's data protection strategy by monitoring, analyzing, investigating, and responding to data loss risks and incidents.

The ideal candidate has hands-on experience with Microsoft Purview and Data Loss Prevention (DLP) technologies, particularly in monitoring, alert management, triaging, policy tuning, and incident investigation. The DLP Analyst will work closely with Security Operations, IT, Legal, HR, and Compliance teams to ensure sensitive information remains protected across endpoint, email, network, and cloud environments.

Key Responsibilities

DLP Monitoring & Analysis

• Monitor DLP alerts and events across endpoint, network, email, and cloud platforms.
• Perform alert triage and validation to identify true positives while minimizing false positives.
• Analyze user activities and data movement patterns to detect potential data leakage, unauthorized access, or policy violations.
• Monitor security events and proactively identify data protection risks.
• Escalate high-risk or complex incidents to senior analysts or management when necessary.

Incident Response & Investigation

• Investigate data loss incidents, insider threats, and suspected data exfiltration events.
• Collect and analyze logs, audit trails, and forensic evidence to determine the scope and impact of incidents.
• Document investigation findings, actions taken, and resolution details in accordance with established procedures.
• Assist with containment, remediation, and recovery activities.
• Collaborate with Security Operations and other stakeholders during incident investigations.

DLP Operations & Policy Management

• Implement, configure, maintain, and tune Microsoft Purview DLP policies to improve detection accuracy.
• Support the creation, enhancement, and maintenance of DLP detection rules and use cases.
• Optimize DLP policies to reduce alert fatigue and false positives.
• Support enterprise data classification and sensitivity labeling initiatives.
• Participate in testing, validation, and deployment of new DLP controls and policy updates.

Collaboration & Stakeholder Support

• Coordinate with IT, Security Operations, and business units to validate alerts and investigate incidents.
• Partner with Legal, HR, Risk, and Compliance teams when handling sensitive or insider-related investigations.
• Recommend process improvements, workflow enhancements, and best practices for DLP operations.

Governance, Risk & Compliance

• Support internal and external audit activities by providing evidence related to DLP controls and incidents.
• Ensure compliance with organizational data protection standards, policies, and regulatory requirements.
• Identify gaps in existing controls and recommend improvements to strengthen data protection capabilities.

Reporting & Continuous Improvement

• Monitor and report DLP metrics, including alert volumes, false positives, incident trends, and policy effectiveness.
• Contribute to continuous improvement initiatives that enhance DLP detection, response, and operational efficiency.
• Stay current with emerging cybersecurity threats, Microsoft security capabilities, and industry best practices.

---

Qualifications

Experience

• 3–5 years of experience in Information Security, Security Operations (SOC), Data Protection, or a related cybersecurity role.

• Hands-on experience with Microsoft Purview Data Loss Prevention (DLP) is required.

• Proven experience in:

  • DLP monitoring and alert management
  • Alert triaging and incident investigation
  • DLP policy implementation and tuning
  • Data protection operations

• Experience with security monitoring, incident response, or threat investigations is highly preferred.

• Experience working in enterprise Microsoft 365 security environments is an advantage.

Technical Skills

• Strong knowledge of Microsoft Purview DLP and Microsoft 365 Security & Compliance.

• Understanding of:

  • Data Loss Prevention (DLP)
  • Data classification and sensitivity labeling
  • Data lifecycle and information protection

• Familiarity with endpoint, email, cloud, and network security concepts.

• Experience using SIEM platforms and log analysis tools.

• Knowledge of Microsoft Defender security technologies is a plus.

• Basic scripting or automation experience using PowerShell or Python is an advantage.

Preferred Certifications

• CompTIA Security+
• Microsoft Certified: Security Operations Analyst (SC-200)
• Microsoft Certified: Information Protection Administrator (SC-400)
• Other relevant cybersecurity or data protection certifications are a plus.