Data Loss Prevention Engineer

Job Description JD For DLP (L1) (1-3 years):-

• Perform initial investigation steps: collect logs, review event context, identify affected

users/data, document timeline.

• Validate alerts: classify true positives vs false positives, assign severity and impact.

• Perform initial investigation steps: collect logs, review event context, identify affected

users/data, document timeline.

• Apply standard playbooks and response procedures; contain incidents where applicable

(e.g., block, quarantine, revoke access) under supervision.

• Escalate confirmed incidents to L2/L3 and incident response teams with clear, welldocumented findings.

• Support periodic rule tuning, whitelist management, and false positive reduction under

guidance.

• Assist with user communication templates for incident notifications and remediation

instructions.

• Participate in scheduled reviews, reporting, and metrics generation (alert volumes, MTTR,

false positive rates).

Preferred qualifications

• Exposure to one or more DLP products (Symantec DLP, Forcepoint DLP, Microsoft

Purview DLP, Netskope, or McAfee/Trellix).

• Experience/Knowledge with regulatory frameworks (GDPR, HIPAA, ISO 27001) and

data privacy basics.

JD For DLP (L2) (3-5 years):-

• Create, modify, and optimize DLP policies using EDM (Exact Data Match), IDM (Indexed

Document Match), regex, and classification labels.

• Analyze recurring false positives, refine matching criteria, and apply exceptions/whitelists

without exposing sensitive data to risk.

• Perform health checks, patch updates, and agent troubleshooting across Endpoint, Network,

Web Proxy, and Cloud DLP components.

• Receive escalated incidents from Tier 1 (SOC/Service Desk), perform root-cause analysis, and

evaluate intent (accidental misuse vs. malicious exfiltration)

• Work with HR, Legal, Compliance, and the broader Incident Response team on high-risk

policy violations or potential insider threats.

• Protect data movement across Removable Media, Email (SMTP), Web/CASB, Printers,

Clipboard, and Cloud Storage (O365, Google Workspace).