Sr. Analyst I - Cyber Defense

invesco; Hyderabad; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

Invesco, a leading global investment firm, seeks a Cyber Defense Operations Lead to drive day-to-day DLP monitoring and URL Filtering profile management. You will coordinate with Insider Risk, Incident Response, DLP Engineering, and Legal/Compliance while guiding analysts and managing high-risk data loss events.

Ideal candidates bring 6+ years in cybersecurity operations with hands-on Palo Alto URL Filtering and DLP experience, plus change management capabilities to support CAB reviews and

Qualifications

• 6+ years of experience in cybersecurity operations, data protection, DLP operations, proxy governance, security operations, or incident handling.
• Hands-on experience with Palo Alto URL Filtering profile management, including Panorama/NGFW or Prisma Access/SASE policy changes.
• Hands-on experience with DLP operations, including alert triage, investigation, evidence collection, dispositioning, escalation, reporting, and operational tuning recommendations.

Responsibilities

• Lead day-to-day DLP monitoring operations, including queue management, prioritization, SLA tracking, quality review, and escalation oversight.
• Guide Analysts during alert triage, evidence collection, case documentation, and true positive versus false positive validation across email, endpoint, Teams, SharePoint, OneDrive, and cloud activity where applicable.
• Own operational escalation for confirmed, high-risk, repeat, or sensitive data loss events and coordinate with Insider Risk, Incident Response, DLP Engineering, Legal/Compliance, and business stakeholders as needed.
• Identify recurring false positives, noisy DLP rules, URL filtering policy friction, data classification gaps, and process pain points; translate findings into tuning, policy, and automation recommendations.
• Lead Palo Alto URL Filtering profile management activities, including policy edits, URL category/profile changes, whitelisting/blacklisting governance, access troubleshooting, exception handling, and operational impact assessment.
• Manage the change lifecycle for URL Filtering and related proxy governance requests, including intake review, risk assessment, approval coordination, implementation validation, rollback planning, evidence capture, and closure documentation.
• Support approved change windows, including weekends and non-business days, as most Palo Alto URL Filtering profile changes are implemented outside normal business hours.
• Participate in weekend on-call support when required to ensure priority URL Filtering profile changes, troubleshooting, validations, and rollback activities are supported during planned maintenance windows.
• Represent Cyber Defense Operations in Change Advisory Board (CAB) meetings to review upcoming URL Filtering changes, provide operational impact input, support approvals, and ensure business requirements are understood.
• Develop and maintain SOPs, runbooks, quality checklists, knowledge articles, and operational playbooks for DLP monitoring and URL Filtering profile management.
• Coach Analysts, review investigation quality, support onboarding, and help maintain consistent operational standards across the team.
• Track and report operational metrics, alert trends and SLA performance across DLP and URL Filtering operations.
• Act as an escalation point for major incidents related to DLP and URL Filtering operations, supporting investigation, troubleshooting, impact assessment and resolution efforts.

Skills

DLP operations

Cyber security operations

Lead/mentoring

Tools

Palo Alto URL Filtering

Panorama/NGFW

Prisma Access/SASE

Job description

As one of the world's leading independent global investment firms, Invesco is dedicated to rethinking possibilities for our clients. By delivering the combined power of our distinctive investment management capabilities, we provide a wide range of investment strategies and vehicles to our clients around the world. If you're looking for challenging work, intelligent colleagues, and exposure across a global footprint, come explore your potential at Invesco.

Job Description

Who we are

With over $2.3 trillion of assets under management, Invesco is one of the world's leading global investment management firms, headquartered in Atlanta, GA. Spreading across 20 countries and with over 8400 dedicated employees, we are driven by trust and care. As one of the world's leading asset managers, we are solely dedicated to delivering an investment experience that helps people get more out of life. If you're looking for challenging work, thoughtful colleagues, and a global employer with social values, explore your potential at Invesco.

Your Team

The Cyber Defense team is responsible for threat detection and monitoring along with DLP alert monitoring and Palo Alto URL Filtering profile management across the enterprise. The team reviews potential data loss events, supports policy-level analysis, manages URL filtering change requests, and troubleshoots access issues through defined change management controls. The team works closely with DLP Engineering, Insider Risk, Incident Response, Network Security, SASE/Proxy Engineering, CAB stakeholders, and business teams to ensure operational outcomes are consistent, risk-based, and well documented.

Your Role

• Lead day-to-day DLP monitoring operations, including queue management, prioritization, SLA tracking, quality review, and escalation oversight.
• Guide Analysts during alert triage, evidence collection, case documentation, and true positive versus false positive validation across email, endpoint, Teams, SharePoint, OneDrive, and cloud activity where applicable.
• Own operational escalation for confirmed, high-risk, repeat, or sensitive data loss events and coordinate with Insider Risk, Incident Response, DLP Engineering, Legal/Compliance, and business stakeholders as needed.
• Identify recurring false positives, noisy DLP rules, URL filtering policy friction, data classification gaps, and process pain points; translate findings into tuning, policy, and automation recommendations.
• Lead Palo Alto URL Filtering profile management activities, including policy edits, URL category/profile changes, whitelisting/blacklisting governance, access troubleshooting, exception handling, and operational impact assessment.
• Manage the change lifecycle for URL Filtering and related proxy governance requests, including intake review, risk assessment, approval coordination, implementation validation, rollback planning, evidence capture, and closure documentation.
• Support approved change windows, including weekends and non-business days, as most Palo Alto URL Filtering profile changes are implemented outside normal business hours.
• Participate in weekend on-call support when required to ensure priority URL Filtering profile changes, troubleshooting, validations, and rollback activities are supported during planned maintenance windows.
• Represent Cyber Defense Operations in Change Advisory Board (CAB) meetings to review upcoming URL Filtering changes, provide operational impact input, support approvals, and ensure business requirements are understood.
• Develop and maintain SOPs, runbooks, quality checklists, knowledge articles, and operational playbooks for DLP monitoring and URL Filtering profile management.
• Coach Analysts, review investigation quality, support onboarding, and help maintain consistent operational standards across the team.
• Track and report operational metrics, alert trends and SLA performance across DLP and URL Filtering operations.
• Act as an escalation point for major incidents related to DLP and URL Filtering operations, supporting investigation, troubleshooting, impact assessment and resolution efforts.

The Experience You Bring

• 6+ years of experience in cybersecurity operations, data protection, DLP operations, proxy governance, security operations, or incident handling; prior lead or senior analyst experience is preferred.
• Hands-on experience with Palo Alto URL Filtering profile management, including Panorama/NGFW or Prisma Access/SASE policy changes, URL categories, security profiles, whitelisting/blacklisting governance, troubleshooting, validation, and rollback support.
• Hands-on experience with DLP operations, including alert triage, investigation, evidence collection, dispositioning, escalation, reporting, and operational tuning recommendations.
• Strong experience supporting security change management activities, including request intake, impact assessment, approvals, CAB representation, implementation validation, evidence capture, and closure documentation.