Data Loss Prevention Engineer
Job Description
JD For DLP (L1) (1-3 years):-
* Perform initial investigation steps: collect logs, review event context, identify affected
users/data, document timeline.
* Validate alerts: classify true positives vs false positives, assign severity and impact.
* Perform initial investigation steps: collect logs, review event context, identify affected
users/data, document timeline.
* Apply standard playbooks and response procedures; contain incidents where applicable
(e.g., block, quarantine, revoke access) under supervision.
* Escalate confirmed incidents to L2/L3 and incident response teams with clear, welldocumented findings.
* Support periodic rule tuning, whitelist management, and false positive reduction under
guidance.
* Assist with user communication templates for incident notifications and remediation
instructions.
* Participate in scheduled reviews, reporting, and metrics generation (alert volumes, MTTR,
false positive rates).
Preferred qualifications
* Exposure to one or more DLP products (Symantec DLP, Forcepoint DLP, Microsoft
Purview DLP, Netskope, or McAfee/Trellix).
* Experience/Knowledge with regulatory frameworks (GDPR, HIPAA, ISO 27001) and
data privacy basics.
JD For DLP (L2) (3-5 years):-
* Create, modify, and optimize DLP policies using EDM (Exact Data Match), IDM (Indexed
Document Match), regex, and classification labels.
* Analyze recurring false positives, refine matching criteria, and apply exceptions/whitelists
without exposing sensitive data to risk.
* Perform health checks, patch updates, and agent troubleshooting across Endpoint, Network,
Web Proxy, and Cloud DLP components.
* Receive escalated incidents from Tier 1 (SOC/Service Desk), perform root-cause analysis, and
evaluate intent (accidental misuse vs. malicious exfiltration)
* Work with HR, Legal, Compliance, and the broader Incident Response team on high-risk
policy violations or potential insider threats.
* Protect data movement across Removable Media, Email (SMTP), Web/CASB, Printers,
Clipboard, and Cloud Storage (O365, Google Workspace).
Preferred qualifications
* Exposure to one or more DLP products (Symantec DLP, Forcepoint DLP, Microsoft
Purview DLP, Netskope, or McAfee/Trellix).
* Experience/Knowledge with regulatory frameworks (GDPR, HIPAA, ISO 27001) and
data privacy basics.