Data Loss Prevention Analyst
Hiscox
Permanent
Build a brilliant future with Hiscox
Role Overview
The Data Loss Prevention (DLP) Analyst will support the organisation's DLP capability by performing day-to-day monitoring, triage, and investigation of DLP alerts across network, endpoint, cloud, and email environments.
Reporting to the Cyber Delivery Lead and taking direction from the DLP Team Lead and DLP Project Manager, this role is responsible for reviewing DLP alerts generated from Zscaler, Microsoft Purview, and Mimecast, determining whether events represent genuine data loss risks or false positives, and escalating confirmed incidents to Privacy or Cyber Security teams as appropriate.
This is a hands-on operational role focused on improving detection quality, reducing false positives, and ensuring timely and consistent handling of DLP events.
Key Responsibilities
DLP Monitoring & Alert Triage
- Monitor DLP alerts across: Zscaler (web and cloud traffic) Microsoft Purview (M365, endpoint, and Insider Risk signals) Mimecast (email DLP and content inspection)
- Perform initial triage of alerts to assess validity, severity, and potential impact
- Investigate alerts using available context (user activity, data classification, destination, behaviour patterns)
- Distinguish between true incidents, policy violations, and false positives
- Conduct detailed analysis of confirmed or high-risk alerts to determine: Nature of the data involved (e.g., personal data, confidential, financial) Intent (accidental vs. potentially malicious) Risk level and potential business impact
- Escalate validated incidents to: Privacy teams for potential data breaches or regulatory concerns Cyber Security / SOC teams for insider threat or malicious activity
- Ensure all escalations include clear, well-documented evidence and context
- Support follow-up investigations when required
- Document all alerts, investigations, and outcomes in designated case management tools
- Follow defined Standard Operating Procedures (SOPs) for alert handling and escalation
- Maintain accurate audit trails to support compliance and regulatory requirements
- Ensure timely resolution of alerts in line with defined SLAs
- Identify recurring false positives and provide feedback to the DLP Team Lead
- Suggest improvements to DLP rules and policies to enhance detection accuracy
- Support tuning activities across Zscaler, Purview, and Mimecast
- Contribute to reducing alert noise and improving signal-to-noise ratio
- Work closely with: DLP Team Lead for guidance and escalation handling Privacy, Legal, and Security Operations teams during investigations
- Participate in review meetings to discuss trends, incidents, and improvements
- Assist in developing and refining operational processes
- Contribute to reporting on: Alert volumes and trends False positive rates Escalation volumes and outcomes
- Highlight emerging risks, unusual activity, or control gaps identified through monitoring
- Experience working with enterprise DLP or security monitoring tools (preferred): Zscaler Microsoft Purview DLP Mimecast
- Experience in a Security Operations, SOC, or monitoring/analysis role
- Strong analytical and investigative skills with attention to detail
- Ability to assess risk and make informed decisions on escalation
- Understanding of data classification and data protection principles (e.g., GDPR)
- Familiarity with incident handling and case management processes
- Ability to follow structured processes and document findings clearly
- Strong communication skills, particularly in documenting and explaining incidents
- Exposure to Insider Risk or User Behaviour Analytics (UBA)
- Experience working with sensitive data environments (e.g., financial, healthcare, or regulated industries)
- Knowledge of email security and web proxy technologies
- Previous experience reducing false positives in monitoring systems