Senior Engineer ILM
Job Description:
What will you be responsible for?
- Monitoring and analyzing Data Loss Prevention (DLP) events across email, endpoint, and web channels using tools such as Microsoft Purview, Mimecast, Forcepoint, or Proofpoint.
- Ensuring timely response to DLP alerts and incidents while maintaining visibility across all data exfiltration vectors.
- Collaborating with Security Operations and other teams to investigate and contain DLP-related incidents.
- Evaluating existing DLP policies and recommending improvements to enhance detection accuracy and reduce false positives.
- Creating detailed incident reports and contributing to lessons learned for DLP-related events.
- Utilizing ITSM platforms like ServiceNow for ticketing, escalation, and SLA adherence.
- Supporting automation efforts for DLP alert triage, reporting, and policy enforcement.
- Participating in DLP engineering activities including tool integration, rule tuning, and testing of new capabilities.
- Ensuring DLP controls align with enterprise security policies and compliance requirements.
- Maintaining documentation for DLP processes, playbooks, and escalation procedures.
- Collaborating with cross-functional teams to ensure DLP coverage across all critical data flows.
- Communicating effectively with stakeholders to report risks, incidents, and mitigation strategies.
What would your work week look like?
- Monitor and respond to DLP alerts across email, endpoint and web channels.
- Perform daily reporting, alert validation, and documentation of DLP events.
- Fine-tune DLP policies and rules to improve detection accuracy and reduce noise.
- Escalate critical DLP incidents and provide timely updates to management and stakeholders.
- Participate in automation initiatives to streamline DLP monitoring and response workflows.
- Conduct root cause analysis for DLP incidents and contribute to continuous improvement.
- Engage in cross-functional meetings to align DLP controls with business and compliance needs.
Who are we looking for?
- Bachelor’s degree in Computer Science, Cybersecurity, or related field, or equivalent experience.
- 3 to 5 years of experience in DLP monitoring or Security Operations Center (SOC) environment.
- Hands-on experience with DLP tools such as Microsoft Purview, Mimecast, Forcepoint, and Proofpoint.
- Familiarity with SIEM platforms (e.g., Microsoft Sentinel, CrowdStrike NG SIEM) and endpoint protection tools (e.g., CrowdStrike, Microsoft Defender).
- Exposure to SOAR platforms and scripting for automation is preferred.
- Familiarity with ITIL processes and willingness to work in 16/7 rotational shifts and provide on-call support.
- Basic security certifications such as CySA+, CEH, or CompTIA Security+ are preferred.
- Strong communication skills and ability to collaborate across teams.
