DLP Security Engineer

We are looking for a skilled and proactive DLP Security Engineer to manage day-to-day Data Loss Prevention (DLP) operations. The role will be responsible for monitoring and investigating DLP events, validating suspicious or policy-violating activities, coordinating with end users and reporting managers, and handling the release or deletion of quarantined/suspicious emails and activities in accordance with approved security policies and SOPs. The role will also involve coordination with senior management, application teams, IT teams, and other stakeholders for timely resolution of DLP incidents and ensuring compliance with organizational security and regulatory requirements.

Responsibilities

• Monitor DLP consoles and security dashboards for email, endpoint, web, USB, file transfer, and other data security events.
• Review and analyze DLP alerts/events and identify genuine incidents, false positives, and policy violations.
• Investigate suspicious emails, attachments, files, and data transfer activities based on organizational DLP policies.
• Validate quarantined or blocked emails and coordinate with end users and reporting managers for appropriate action.
• Process release, delete, or approve actions for quarantined emails/activities based on approved authorization and SOP.
• Coordinate with Reporting Managers, HODs, CISO/Security team, and other higher officials for approval and resolution of sensitive or high-risk DLP events.
• Escalate critical or suspicious data leakage incidents to the appropriate security and management teams.
• Monitor and handle USB, Bluetooth, clipboard, file transfer, web upload/download, cloud storage, and other endpoint DLP events.
• Analyze DLP incidents involving sensitive information such as PAN, Aadhaar, financial information, customer data, credentials, confidential documents, and other regulated data.
• Perform incident validation and maintain proper documentation/evidence for each DLP incident.
• Coordinate with IT, Application, Infrastructure, HR, and Business teams for incident investigation and resolution.
• Maintain DLP incident/ticket records, approval details, actions taken, and closure remarks.
• Prepare daily/weekly/monthly DLP monitoring and incident reports for management review.
• Identify recurring false positives and support DLP policy/rule tuning to improve detection accuracy and reduce unnecessary alerts.
• Support implementation, testing, and optimization of new DLP policies and controls.
• Participate in DLP-related audit, compliance, RBI/DPDP, and information security assessments and provide required evidence.
• Ensure all DLP actions are performed in accordance with approved SOPs, security policies, and authorization matrices.
• Support DLP tool upgrades, policy changes, troubleshooting, and coordination with the DLP OEM/vendor.
• Participate in security incident investigations and provide relevant DLP logs/evidence to the Incident Response team.
• Maintain confidentiality while handling sensitive business, customer, employee, and financial information.

Required Skills

• Experience in Data Loss Prevention (DLP) operations and security monitoring.
• Good understanding of Email DLP, Endpoint DLP, USB/device control, file transfer monitoring, and data classification.
• Experience in investigating security alerts and performing incident triage and escalation.
• Understanding of PII, sensitive data, data classification, data leakage risks, and information security controls.
• Good analytical and troubleshooting skills.
• Strong communication and stakeholder-management skills.
• Ability to coordinate effectively with end users, managers, HODs, senior management, IT teams, and security teams.
• Good documentation and reporting skills.
• Ability to work in a 24x7/security operations environment, if required.