Data Loss Prevention Analyst

Job Type:

Permanent

Build a brilliant future with Hiscox

Role Overview

The Data Loss Prevention (DLP) Analyst will support the organisation's DLP capability by performing day-to-day monitoring, triage, and investigation of DLP alerts across network, endpoint, cloud, and email environments.

Reporting to the Cyber Delivery Lead and taking direction from the DLP Team Lead and DLP Project Manager, this role is responsible for reviewing DLP alerts generated from Zscaler, Microsoft Purview, and Mimecast, determining whether events represent genuine data loss risks or false positives, and escalating confirmed incidents to Privacy or Cyber Security teams as appropriate.

This is a hands-on operational role focused on improving detection quality, reducing false positives, and ensuring timely and consistent handling of DLP events.

Key Responsibilities

DLP Monitoring & Alert Triage

• Monitor DLP alerts across: Zscaler (web and cloud traffic) Microsoft Purview (M365, endpoint, and Insider Risk signals) Mimecast (email DLP and content inspection)
• Perform initial triage of alerts to assess validity, severity, and potential impact
• Investigate alerts using available context (user activity, data classification, destination, behaviour patterns)
• Distinguish between true incidents, policy violations, and false positives

Incident Investigation & Escalation

• Conduct detailed analysis of confirmed or high-risk alerts to determine: Nature of the data involved (e.g., personal data, confidential, financial) Intent (accidental vs. potentially malicious) Risk level and potential business impact
• Escalate validated incidents to: Privacy teams for potential data breaches or regulatory concerns Cyber Security / SOC teams for insider threat or malicious activity
• Ensure all escalations include clear, well-documented evidence and context
• Support follow-up investigations when required

Alert Handling & Case Management

• Document all alerts, investigations, and outcomes in designated case management tools
• Follow defined Standard Operating Procedures (SOPs) for alert handling and escalation
• Maintain accurate audit trails to support compliance and regulatory requirements
• Ensure timely resolution of alerts in line with defined SLAs

Policy Tuning & Continuous Improvement

• Identify recurring false positives and provide feedback to the DLP Team Lead
• Suggest improvements to DLP rules and policies to enhance detection accuracy
• Support tuning activities across Zscaler, Purview, and Mimecast
• Contribute to reducing alert noise and improving signal-to-noise ratio

Collaboration & Support

• Work closely with: DLP Team Lead for guidance and escalation handling Privacy, Legal, and Security Operations teams during investigations
• Participate in review meetings to discuss trends, incidents, and improvements
• Assist in developing and refining operational processes

Reporting & Metrics

• Contribute to reporting on: Alert volumes and trends False positive rates Escalation volumes and outcomes
• Highlight emerging risks, unusual activity, or control gaps identified through monitoring

Key Skills & Experience

• Experience working with enterprise DLP or security monitoring tools (preferred): Zscaler Microsoft Purview DLP Mimecast
• Experience in a Security Operations, SOC, or monitoring/analysis role
• Strong analytical and investigative skills with attention to detail
• Ability to assess risk and make informed decisions on escalation
• Understanding of data classification and data protection principles (e.g., GDPR)
• Familiarity with incident handling and case management processes
• Ability to follow structured processes and document findings clearly
• Strong communication skills, particularly in documenting and explaining incidents

Desirable Experience

• Exposure to Insider Risk or User Behaviour Analytics (UBA)
• Experience working with sensitive data environments (e.g., financial, healthcare, or regulated industries)
• Knowledge of email security and web proxy technologies
• Previous experience reducing false positives in monitoring systems

Work with amazing people and be part of a unique culture

Why work here?

If you want to help build a brilliant future; work with amazing people; be part of a unique company culture; and, of course, enjoy great employee benefits that take care of your mental and physical wellbeing, come and join us.

Get in touch

If this is your first time visiting our career site and you wish to stay in touch please select the 'Introduce yourself' button on the top right. This will allow us to contact you with suitable vacancies. If you are a returning prospect and wish to view our current vacancies please Search for Jobs using the link on the top right.

About us

We’re a global, specialist insurer headquartered in Bermuda and listed on the London Stock Exchange. With 3,000 employees and 32 offices in 12 countries we’re a business with lots of opportunity for people with talent, spark and lots of ambition. If you want to build a great career with a company that prioritises strong values – such as integrity and courage – where our people always pull together to do the right thing for each other and our customers, then we’d love to hear from you.