Data Loss Prevention Analyst

Hiscox Underwriting Group Services Ltd Portugal (HUGS PT); Lisboa; On-site; EUR 45,000 - 66,000; Full time

Job summary

Hiscox is seeking a Data Loss Prevention (DLP) Analyst in Lisbon to support its DLP capability by monitoring, triaging, and investigating alerts across network, endpoint, cloud, and email systems. You will review alerts from Zscaler, Purview, and Mimecast and determine genuine risks or false positives, escalating confirmed incidents as needed.

This hands-on role focuses on improving detection quality, reducing noise, and ensuring timely handling of DLP events in collaboration with Privacy and

Qualifications

• Experience with enterprise DLP or security monitoring tools.
• Strong analytical and investigative skills with attention to detail.
• Experience in Security Operations, SOC, or monitoring/analysis roles.
• Familiarity with data classification and GDPR principles.

Responsibilities

• Monitor and triage DLP alerts across networks and cloud environments.
• Investigate alerts to determine true incidents or false positives.
• Escalate validated incidents to Privacy or Cyber Security teams with evidence.
• Document investigations in case management tools and ensure SLA alignment.
• Support process improvements for DLP rule tuning and noise reduction.

Skills

Data security analysis

DLP monitoring

Threat investigation

Tools

Zscaler

Microsoft Purview

Mimecast

Job description

Job Type: Permanent

Build a brilliant future with Hiscox

Role Overview

The Data Loss Prevention (DLP) Analyst will support the organisation's DLP capability by performing day-to-day monitoring, triage, and investigation of DLP alerts across network, endpoint, cloud, and email environments. Reporting to the Cyber Delivery Lead and taking direction from the DLP Team Lead and DLP Project Manager, this role is responsible for reviewing DLP alerts generated from Zscaler, Microsoft Purview, and Mimecast, determining whether events represent genuine data loss risks or false positives, and escalating confirmed incidents to Privacy or Cyber Security teams as appropriate. This is a hands-on operational role focused on improving detection quality, reducing false positives, and ensuring timely and consistent handling of DLP events.

Key Responsibilities

DLP Monitoring & Alert Triage

• Monitor DLP alerts across: Zscaler (web and cloud traffic) Microsoft Purview (M365, endpoint, and Insider Risk signals) Mimecast (email DLP and content inspection)
• Perform initial triage of alerts to assess validity, severity, and potential impact
• Investigate alerts using available context (user activity, data classification, destination, behaviour patterns)
• Distinguish between true incidents, policy violations, and false positives

Incident Investigation & Escalation

• Conduct detailed analysis of confirmed or high-risk alerts to determine: Nature of the data involved (e.g., personal data, confidential, financial) Intent (accidental vs. potentially malicious) Risk level and potential business impact
• Escalate validated incidents to: Privacy teams for potential data breaches or regulatory concerns Cyber Security / SOC teams for insider threat or malicious activity
• Ensure all escalations include clear, well-documented evidence and context
• Support follow-up investigations when required

Alert Handling & Case Management

• Document all alerts, investigations, and outcomes in designated case management tools
• Follow defined Standard Operating Procedures (SOPs) for alert handling and escalation
• Maintain accurate audit trails to support compliance and regulatory requirements
• Ensure timely resolution of alerts in line with defined SLAs

Policy Tuning & Continuous Improvement

• Identify recurring false positives and provide feedback to the DLP Team Lead
• Suggest improvements to DLP rules and policies to enhance detection accuracy
• Support tuning activities across Zscaler, Purview, and Mimecast
• Contribute to reducing alert noise and improving signal-to-noise ratio

Collaboration & Support

• Work closely with: DLP Team Lead for guidance and escalation handling Privacy, Legal, and Security Operations teams during investigations Participate in review meetings to discuss trends, incidents, and improvements Assist in developing and refining operational processes

Reporting & Metrics

• Contribute to reporting on: Alert volumes and trends False positive rates Escalation volumes and outcomes Highlight emerging risks, unusual activity, or control gaps identified through monitoring

Key Skills & Experience

• Experience working with enterprise DLP or security monitoring tools (preferred): Zscaler Microsoft Purview DLP Mimecast
• Experience in a Security Operations, SOC, or monitoring/analysis role
• Strong analytical and investigative skills with attention to detail
• Ability to assess risk and make informed decisions on escalation
• Understanding of data classification and data protection principles (e.g., GDPR)
• Familiarity with incident handling and case management processes
• Ability to follow structured processes and document findings clearly
• Strong communication skills, particularly in documenting and explaining incidents

Desirable Experience

• Exposure to Insider Risk or User Behaviour Analytics (UBA)
• Experience working with sensitive data environments (e.g., financial, healthcare, or regulated industries)
• Knowledge of email security and web proxy technologies
• Previous experience reducing false positives in monitoring systems

Work with amazing people and be part of a unique culture

We’re a global, specialist insurer headquartered in Bermuda and listed on the London Stock Exchange. With 3,000 employees and 32 offices in 12 countries we’re a business with lots of opportunity for people with talent, spark and lots of ambition.