Data Loss Prevention Analyst

Hiscox; York and North Yorkshire; On-site; GBP 42,000 - 58,000; Full time

Job summary

Hiscox is seeking a DLP Analyst to support the organisation's data loss prevention capabilities. You will monitor alerts across network, endpoint, cloud, and email environments, performing triage to distinguish true risks from false positives, and escalating confirmed incidents to Privacy or Cyber teams.

This hands-on role focuses on improving detection quality, reducing false positives, and ensuring timely handling of DLP events in line with SLAs.

Qualifications

• Experience in security monitoring or SOC environments.
• Ability to triage alerts and assess risk quickly.
• Strong written and verbal communication for incident reports.
• Familiarity with data protection principles (GDPR).

Responsibilities

• Monitor DLP alerts across Zscaler, Purview and Mimecast.
• Perform initial triage to assess validity and impact.
• Escalate confirmed incidents with evidence to Privacy/Cyber teams.
• Document investigations in case management tools and comply with SOPs.

Skills

Analytical thinking

Investigation

Risk assessment

Communication

Documentation

Tools

Zscaler

Microsoft Purview

Mimecast

Job description

Job Type:

Permanent

Build a brilliant future with Hiscox

Role Overview

The Data Loss Prevention (DLP) Analyst will support the organisation's DLP capability by performing day-to-day monitoring, triage, and investigation of DLP alerts across network, endpoint, cloud, and email environments.

Reporting to the Cyber Delivery Lead and taking direction from the DLP Team Lead and DLP Project Manager, this role is responsible for reviewing DLP alerts generated from Zscaler, Microsoft Purview, and Mimecast, determining whether events represent genuine data loss risks or false positives, and escalating confirmed incidents to Privacy or Cyber Security teams as appropriate.

This is a hands‑on operational role focused on improving detection quality, reducing false positives, and ensuring timely and consistent handling of DLP events.

Key Responsibilities

DLP Monitoring & Alert Triage

• Monitor DLP alerts across: Zscaler (web and cloud traffic) Microsoft Purview (M365, endpoint, and Insider Risk signals) Mimecast (email DLP and content inspection)
• Perform initial triage of alerts to assess validity, severity, and potential impact
• Investigate alerts using available context (user activity, data classification, destination, behaviour patterns)
• Distinguish between true incidents, policy violations, and false positives

Incident Investigation & Escalation

• Conduct detailed analysis of confirmed or high‑risk alerts to determine: Nature of the data involved (e.g., personal data, confidential, financial) Intent (accidental vs. potentially malicious) Risk level and potential business impact
• Escalate validated incidents to: Privacy teams for potential data breaches or regulatory concerns Cyber Security / SOC teams for insider threat or malicious activity
• Ensure all escalations include clear, well‑documented evidence and context
• Support follow‑up investigations when required

Alert Handling & Case Management

• Document all alerts, investigations, and outcomes in designated case management tools
• Follow defined Standard Operating Procedures (SOPs) for alert handling and escalation
• Maintain accurate audit trails to support compliance and regulatory requirements
• Ensure timely resolution of alerts in line with defined SLAs

Policy Tuning & Continuous Improvement

• Identify recurring false positives and provide feedback to the DLP Team Lead
• Suggest improvements to DLP rules and policies to enhance detection accuracy
• Support tuning activities across Zscaler, Purview, and Mimecast
• Contribute to reducing alert noise and improving signal‑to‑noise ratio

Collaboration & Support

• Work closely with: DLP Team Lead for guidance and escalation handling Privacy, Legal, and Security Operations teams during investigations
• Participate in review meetings to discuss trends, incidents, and improvements
• Assist in developing and refining operational processes

Reporting & Metrics

• Contribute to reporting on: Alert volumes and trends False positive rates Escalation volumes and outcomes
• Highlight emerging risks, unusual activity, or control gaps identified through monitoring

Key Skills & Experience

• Experience working with enterprise DLP or security monitoring tools (preferred): Zscaler Microsoft Purview DLP Mimecast
• Experience in a Security Operations, SOC, or monitoring/analysis role
• Strong analytical and investigative skills with attention to detail
• Ability to assess risk and make informed decisions on escalation
• Understanding of data classification and data protection principles (e.g., GDPR)
• Familiarity with incident handling and case management processes
• Ability to follow structured processes and document findings clearly
• Strong communication skills, particularly in documenting and explaining incidents

Desirable Experience

• Exposure to Insider Risk or User Behaviour Analytics (UBA)
• Experience working with sensitive data environments (e.g., financial, healthcare, or regulated industries)
• Knowledge of email security and web proxy technologies
• Previous experience reducing false positives in monitoring systems

Work with amazing people and be part of a unique culture