Analyst - Cyber Defense

Your Team

The Cyber Defense team is responsible for monitoring Security alerts, investigating potential data loss events, and helping protect sensitive information across the enterprise. The team works closely with Engineering, Insider Risk, to ensure alerts are reviewed consistently, and risk-based outcomes are documented. This role is part of the operational team that provides insights, tuning recommendations, and policy-level suggestions to the DLP Committee while Engineering continues to own implementation of platform and policy changes.

Your Role

• 3+ Yrs of experience in cyber security.
• Monitor and triage DLP alerts, including email, endpoint, Teams/SharePoint/OneDrive, and cloud activity where applicable.
• Review alert context, validate true positives versus false positives, collect supporting evidence, and document outcomes clearly.
• In consultation with the Insider Threat Team, assist in engaging users and business contacts when additional context or business justification is required for data movement activity.
• Escalate confirmed, high-risk, or repeat data loss events to the Senior DLP Operations Lead, Incident Response, Insider Risk, as appropriate.
• Identify recurring false positives, noisy rules, data classification gaps, and process pain points; provide tuning and policy-level recommendations to the DLP Engineering team.
• Support operational reporting by tracking alert volumes, disposition trends, SLA adherence, repeat offenders, common data types, and control effectiveness indicators.
• Identify opportunities to automate repetitive investigation steps such as enrichment, evidence collection, user notification, ticket routing, case closure, and reporting.
• Contribute operational observations and metrics for DLP Committee discussions, including emerging risks, policy friction points, and recommended improvement actions.

Academic Requirements

• Bachelors degree in computer science, Information Technology, Cybersecurity, Information Security, or a related discipline; equivalent practical experience may be considered.
• Foundational understanding of data protection, information security, security operations, incident handling, and enterprise collaboration platforms.
• Exposure to Microsoft Purview DLP, Microsoft 365 security/compliance tools, SIEM, ticketing systems, or case management workflows is preferred but not mandatory.
• Professional certifications such as Microsoft SC-400, SC-200, Security+, SSCP, or equivalent security/privacy certifications are preferred but not mandatory.
• Strong written communication, analytical thinking, attention to detail, and ability to document investigation findings in a clear, audit-ready manner.

Job Type

Full time

Worker Type

Employee

Job Exempt

Yes

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.