Data Loss Prevention Analyst

Hiscox•Lisbon, NY

10d

About The Position

The Data Loss Prevention (DLP) Analyst supports the organisation’s DLP capability through day-to-day monitoring, triage, and investigation of alerts across network, endpoint, cloud, and email environments. The analyst reviews alerts generated by Zscaler, Microsoft Purview, and Mimecast, determines whether they represent genuine data-loss risks or false positives, and escalates confirmed incidents to Privacy or Cyber Security teams as appropriate. This is a hands-on operational role focused on improving detection quality, reducing false positives, and ensuring timely, consistent handling of DLP events. The role reports to the Cyber Delivery Lead and takes direction from the DLP Team Lead and DLP Project Manager. The analyst also works with Privacy, Legal, and Security Operations teams during investigations, contributes to operational process improvements, and supports reporting on alert trends, false positives, and escalations.

Requirements

Experience in a Security Operations, SOC, or monitoring and analysis role.
Strong analytical and investigative skills, with attention to detail.
Ability to assess risk and make informed escalation decisions.
Understanding of data classification and data protection principles, such as GDPR.
Familiarity with incident-handling and case-management processes.
Ability to follow structured processes and document findings clearly.
Strong communication skills, particularly when documenting and explaining incidents.

Nice To Haves

Experience with enterprise DLP or security monitoring tools, particularly Zscaler, Microsoft Purview DLP, or Mimecast.
Exposure to Insider Risk or User Behaviour Analytics (UBA).
Experience working with sensitive-data environments, such as financial, healthcare, or regulated industries.
Knowledge of email security and web proxy technologies.
Previous experience reducing false positives in monitoring systems.

Responsibilities

Monitor DLP alerts across Zscaler web and cloud traffic, Microsoft Purview M365, endpoint, and Insider Risk signals, and Mimecast email DLP and content inspection.
Triage alerts to assess validity, severity, and potential impact.
Investigate alerts using context such as user activity, data classification, destination, and behaviour patterns.
Distinguish true incidents and policy violations from false positives.
Analyze confirmed or high-risk alerts to determine the nature of the data involved, intent, risk level, and potential business impact.
Escalate potential data breaches or regulatory concerns to Privacy teams and insider threat or malicious activity to Cyber Security or SOC teams.
Provide clear, well-documented evidence and context with escalations, and support follow-up investigations when required.
Document alerts, investigations, and outcomes in designated case management tools.
Follow standard operating procedures for alert handling and escalation, maintain audit trails, and resolve alerts within defined SLAs.
Identify recurring false positives and provide feedback to the DLP Team Lead.
Suggest and support tuning of DLP rules and policies across Zscaler, Purview, and Mimecast to improve detection accuracy and reduce alert noise.
Collaborate with the DLP Team Lead and Privacy, Legal, and Security Operations teams; participate in review meetings and help refine operational processes.
Contribute to reporting on alert volumes and trends, false-positive rates, and escalation volumes and outcomes.
Highlight emerging risks, unusual activity, and control gaps identified through monitoring.