Data Loss Prevention Analyst

Hiscox; Lisboa; Hybrid; EUR 40,000 - 60,000; Full time

Job summary

Hiscox is seeking a Data Loss Prevention Analyst to join our hybrid team in Lisbon. You will monitor DLP alerts from Zscaler, Microsoft Purview and Mimecast, triage events, and investigate potential data loss incidents.

You will escalate confirmed incidents to Privacy or Cyber Security teams with detailed evidence, while maintaining audit trails and following SOPs. The role emphasizes reducing false positives, improving detection quality, and supporting follow-up investigations.

Qualifications

• Experience with enterprise DLP or security monitoring tools is preferred.
• Strong analytical and investigative skills with attention to detail.
• Familiarity with GDPR and data protection principles and incident handling.

Responsibilities

• Monitor DLP alerts across Zscaler, Purview, and Mimecast and perform initial triage.
• Conduct detailed analysis of confirmed or high-risk alerts and escalation.
• Document alerts, investigations and outcomes in case management tools.
• Tune DLP rules and policies to reduce false positives and improve detection accuracy.
• Collaborate with Privacy, Legal and Cyber Security teams during investigations.
• Report on alert volumes, trends, false positives, and escalations.

Skills

DLP Monitoring

Alert triage

Investigation

Incident escalation

SOP compliance

Collaboration

Tools

Zscaler

Microsoft Purview

Mimecast

Job description

## Data Loss Prevention AnalystApply: Hybrid: Lisbon: York: Full time: Posted Today: R0020410**Job Type:**Permanent**Build a brilliant future with Hiscox**## Role Overview The Data Loss Prevention (DLP) Analyst will support the organisation's DLP capability by performing day-to-day monitoring, triage, and investigation of DLP alerts across network, endpoint, cloud, and email environments.Reporting to the Cyber Delivery Lead and taking direction from the DLP Team Lead and DLP Project Manager, this role is responsible for reviewing DLP alerts generated from Zscaler, Microsoft Purview, and Mimecast, determining whether events represent genuine data loss risks or false positives, and escalating confirmed incidents to Privacy or Cyber Security teams as appropriate.This is a hands-on operational role focused on improving detection quality, reducing false positives, and ensuring timely and consistent handling of DLP events. ## Key ResponsibilitiesDLP Monitoring & Alert Triage* Monitor DLP alerts across: Zscaler (web and cloud traffic) Microsoft Purview (M365, endpoint, and Insider Risk signals) Mimecast (email DLP and content inspection)* Perform initial triage of alerts to assess validity, severity, and potential impact* Investigate alerts using available context (user activity, data classification, destination, behaviour patterns)* Distinguish between true incidents, policy violations, and false positivesIncident Investigation & Escalation* Conduct detailed analysis of confirmed or high-risk alerts to determine: Nature of the data involved (e.g., personal data, confidential, financial) Intent (accidental vs. potentially malicious) Risk level and potential business impact* Escalate validated incidents to: Privacy teams for potential data breaches or regulatory concerns Cyber Security / SOC teams for insider threat or malicious activity* Ensure all escalations include clear, well-documented evidence and context* Support follow-up investigations when requiredAlert Handling & Case Management* Document all alerts, investigations, and outcomes in designated case management tools* Follow defined Standard Operating Procedures (SOPs) for alert handling and escalation* Maintain accurate audit trails to support compliance and regulatory requirements* Ensure timely resolution of alerts in line with defined SLAsPolicy Tuning & Continuous Improvement* Identify recurring false positives and provide feedback to the DLP Team Lead* Suggest improvements to DLP rules and policies to enhance detection accuracy* Support tuning activities across Zscaler, Purview, and Mimecast* Contribute to reducing alert noise and improving signal-to-noise ratioCollaboration & Support* Work closely with: DLP Team Lead for guidance and escalation handling Privacy, Legal, and Security Operations teams during investigations* Participate in review meetings to discuss trends, incidents, and improvements* Assist in developing and refining operational processesReporting & Metrics* Contribute to reporting on: Alert volumes and trends False positive rates Escalation volumes and outcomes* Highlight emerging risks, unusual activity, or control gaps identified through monitoring ## Key Skills & Experience* Experience working with enterprise DLP or security monitoring tools (preferred): Zscaler Microsoft Purview DLP Mimecast* Experience in a Security Operations, SOC, or monitoring/analysis role* Strong analytical and investigative skills with attention to detail* Ability to assess risk and make informed decisions on escalation* Understanding of data classification and data protection principles (e.g., GDPR)* Familiarity with incident handling and case management processes* Ability to follow structured processes and document findings clearly* Strong communication skills, particularly in documenting and explaining incidents ## Desirable Experience* Exposure to Insider Risk or User Behaviour Analytics (UBA)* Experience working with sensitive data environments (e.g., financial, healthcare, or regulated industries)* Knowledge of email security and web proxy technologies* Previous experience reducing false positives in monitoring systems