Data Loss Prevention Engineer

Job Description

JD For DLP (L1) (1-3 years):-

* Perform initial investigation steps: collect logs, review event context, identify affected

users/data, document timeline.

* Validate alerts: classify true positives vs false positives, assign severity and impact.

* Perform initial investigation steps: collect logs, review event context, identify affected

users/data, document timeline.

* Apply standard playbooks and response procedures; contain incidents where applicable

(e.g., block, quarantine, revoke access) under supervision.

* Escalate confirmed incidents to L2/L3 and incident response teams with clear, welldocumented findings.

* Support periodic rule tuning, whitelist management, and false positive reduction under

guidance.

* Assist with user communication templates for incident notifications and remediation

instructions.

* Participate in scheduled reviews, reporting, and metrics generation (alert volumes, MTTR,

false positive rates).

Preferred qualifications

* Exposure to one or more DLP products (Symantec DLP, Forcepoint DLP, Microsoft

Purview DLP, Netskope, or McAfee/Trellix).

* Experience/Knowledge with regulatory frameworks (GDPR, HIPAA, ISO 27001) and

data privacy basics.

JD For DLP (L2) (3-5 years):-

* Create, modify, and optimize DLP policies using EDM (Exact Data Match), IDM (Indexed

Document Match), regex, and classification labels.

* Analyze recurring false positives, refine matching criteria, and apply exceptions/whitelists

without exposing sensitive data to risk.

* Perform health checks, patch updates, and agent troubleshooting across Endpoint, Network,

Web Proxy, and Cloud DLP components.

* Receive escalated incidents from Tier 1 (SOC/Service Desk), perform root-cause analysis, and

evaluate intent (accidental misuse vs. malicious exfiltration)

* Work with HR, Legal, Compliance, and the broader Incident Response team on high-risk

policy violations or potential insider threats.

* Protect data movement across Removable Media, Email (SMTP), Web/CASB, Printers,

Clipboard, and Cloud Storage (O365, Google Workspace).

Preferred qualifications

* Exposure to one or more DLP products (Symantec DLP, Forcepoint DLP, Microsoft

Purview DLP, Netskope, or McAfee/Trellix).

* Experience/Knowledge with regulatory frameworks (GDPR, HIPAA, ISO 27001) and

data privacy basics.