IAM & DLP Lead, APAC

Liberty Specialty Markets; India; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

Liberty Specialty Markets seeks an IAM (Identity & Access Management) & DLP (Data Loss Prevention) Lead to establish unified access governance and data protection frameworks across APAC insurance markets. You will translate global standards into locally compliant guidelines, SOPs, and access certification processes while aligning with market CISOs and regulators.

You will design DLP controls across endpoints, email, cloud, and web, tune rules, and maintain audit-ready evidence.

Qualifications

• 10+ years in identity and access management, data loss prevention, or IT governance
• Hands-on with access certification, user access reviews, privileged access management, and separation of duties
• Experience implementing and managing DLP solutions across endpoints, email, cloud, and web
• Developing IAM/DLP policies, guidelines, SOPs, or control documentation in regulated environments
• Familiarity with APAC regulatory expectations (MAS, HKIA, APRA, BNM, NFRA, IRDAI)
• Knowledge of ISO 27001, NIST CSF, or SOC 2 frameworks

Responsibilities

• Define and operationalize IAM and DLP governance for APAC markets
• Translate global standards into locally compliant frameworks and SOPs
• Lead access reviews for all account types and drive remediation of gaps
• Tune and monitor DLP policies; establish incident triage workflows
• Coordinate with CISOs, compliance, and risk teams; prepare audit evidence and reports
• Maintain documentation and run periodic policy effectiveness reviews

Skills

Access governance

DLP governance

Policy development

Stakeholder management

Audit readiness

Regulatory compliance

Documentation

Incident triage

Risk assessment

Alignment with global standards

Tools

Microsoft Purview

Proofpoint

SailPoint

Microsoft Entra ID

CyberArk

Job description

We're hiring an **IAM (Identity & Access Management) & DLP (Data Loss Prevention) Lead** to establish and operationalize unified access governance and data loss prevention frameworks across our APAC insurance markets. Working from the global IAM and Data Security teams' policy references, you'll translate enterprise standards into practical, locally compliant frameworks – setting up local guidelines, SOPs, access certification processes, and DLP controls for each market. You'll partner closely with market CISOs to shape and execute the IAM and DLP roadmap, drive user access reviews across all account types, implement and tune DLP policies to protect sensitive data, and ensure the entire program is audit-ready against local regulatory expectations. This role is ideal for someone who can balance global consistency with local regulatory reality across both access governance and data protection, and who takes pride in building durable, well-documented governance.**Access Governance Framework**• Establish an access governance framework for APAC, using the global IAM team's policies and standards as the authoritative reference point• Adapt and operationalize global IAM principles to fit the APAC market context, leveraging the global team's capabilities, tooling, and patterns wherever possible• Design a unified, consistent IAM framework that works across all in-scope APAC markets while accommodating local regulatory and operational differences• Where global standards cannot be implemented as-is in a given market, raise, document, and manage formal security exceptions through the appropriate risk acceptance process**Data Loss Prevention (DLP) Framework**• Establish a DLP governance framework for APAC, aligned to the global Data Security team's policies and data classification standards• Define and operationalize DLP policies across endpoint, email, cloud, and web channels to prevent unauthorized disclosure of sensitive and regulated data (PII, policyholder data, financial records, intellectual property)• Adapt global DLP rules and detection logic to accommodate local data types, languages, and regulatory requirements specific to each APAC market• Design and maintain data classification schemas and sensitive information types relevant to APAC insurance operations• Where global DLP standards cannot be applied as-is, raise, document, and manage formal security exceptions through the appropriate risk acceptance process**DLP Policy Management & Tuning**• Develop, test, and deploy DLP policies using Microsoft Purview and Proofpoint across email, endpoints, cloud applications, and collaboration platforms• Continuously monitor and tune DLP rules to reduce false positives while maintaining detection efficacy for true data exposure risks• Define and manage DLP response actions (block, quarantine, notify, encrypt) appropriate to the sensitivity of the data and the regulatory context of each market• Establish incident triage workflows for DLP alerts - including escalation paths, investigation procedures, and evidence preservation• Conduct periodic reviews of DLP policy effectiveness and produce metrics on policy hits, incidents, trends, and remediation outcomes**Local Guidelines, SOPs & Procedures**• Develop and maintain local IAM and DLP guidelines, SOPs, and work instructions for each APAC market• Ensure procedures clearly define roles, responsibilities, approval workflows, and escalation paths for both access governance and data protection• Keep documentation current as global policy, local regulation, and tooling evolve**Access Certification & User Access Reviews**• Set up and run access certification and periodic user access review (UAR) processes covering all account types - standard user, privileged, service, shared, and third-party/vendor accounts• Define review cadence, scope, ownership, and evidence requirements per market• Track review completion, remediate identified access gaps and toxic combinations, and confirm closure• Drive continuous improvement in certification quality, automation, and reviewer accountability**DLP Monitoring, Incident Response & Reporting**• Monitor DLP dashboards and alert queues, triaging and investigating potential data leakage incidents across all channels• Coordinate with market CISOs, legal, compliance, and HR on confirmed DLP incidents, ensuring appropriate containment and remediation• Maintain DLP incident records with full traceability - detection, investigation, response, root cause, and closure• Produce periodic DLP reporting for market CISOs covering incident volumes, trends, top triggered policies, high-risk users/departments, and remediation status• Drive user awareness and behaviour change through targeted engagement informed by DLP findings**Regulatory Compliance & Audit Readiness**• Identify and interpret IAM- and DLP-relevant regulatory requirements across MAS, HKIA, APRA, BNM, NFRA, and IRDAI (e.g., access control, segregation of duties, privileged access, periodic recertification, logging, data protection, cross-border data transfer, breach notification)• Map local requirements into the access governance and DLP frameworks and ensure procedures demonstrably comply• Maintain the IAM and DLP programs in a continuously audit-ready state - complete, current evidence; clear traceability from control to procedure to execution• Support internal audits, external audits, and regulatory inspections, and drive closure of any IAM- or DLP-related findings**Stakeholder Engagement & Reporting**• Partner with market CISOs to define, prioritize, and execute the IAM and DLP roadmap for each market• Provide periodic reporting to market CISOs on progress, key risks, challenges, exceptions, and remediation status across both IAM and DLP• Coordinate with the global IAM team, Data Security team, local IT, application owners, HR, and risk/compliance functions to keep the frameworks aligned and effective• Escalate blockers and emerging risks promptly with clear, decision-ready context**Requirements:**• 10+ years of experience in identity and access management, data loss prevention, IT governance, security, or a closely related field• Hands-on experience with access governance processes - access certification, user access reviews, joiner/mover/leaver, privileged access management, and segregation of duties• Hands-on experience implementing and managing DLP solutions, including policy creation, tuning, incident triage, and reporting• Demonstrated experience with DLP tooling, specifically Microsoft Purview (Information Protection, DLP, Insider Risk Management) and Proofpoint (Email DLP, Content Compliance)• Demonstrated experience developing IAM and/or DLP policies, guidelines, SOPs, or control documentation in a regulated environment• Understanding of IAM concepts and tooling (RBAC/ABAC, SSO, MFA, SailPoint, Microsoft Entra ID, and PAM tools such as CyberArk or Delinea)• Understanding of data classification frameworks, sensitive information types, and data handling requirements in financial services• Familiarity with IAM- and DLP-relevant regulatory and control expectations across one or more APAC markets (MAS, HKIA, APRA, BNM, NFRA, IRDAI)• Familiarity with control frameworks such as ISO 27001, NIST CSF, or SOC 2• Experience supporting audits and regulatory inspections, and managing findings to closure• Strong documentation and stakeholder management skills, including the ability to report clearly to senior stakeholders such as CISOs• Highly organized, with the ability to manage multiple market workstreams in parallel• Prior experience in insurance or broader financial services• Relevant certifications (CISA, CRISC, CISM, SailPoint certifications, Microsoft Security certifications, or equivalent)