DLP Analyst: Insider Risk & Data Protection Lead

Nightfall AI; United States; Remote; USD 110,000 - 170,000; Full time

Job summary

Nightfall AI is seeking a DLP Analyst to protect customer data across endpoints, SaaS, and GenAI tools. You will become an expert on Nightfall’s DLP platform, partnering with security teams to operationalize data loss prevention, investigate incidents, and advise on insider threat mitigation.

You’ll tune policies, monitor alerts, and deliver actionable reports while balancing technical precision with business context.

Qualifications

• 3-5 years of experience in information security, with at least 2 years focused on data loss prevention (DLP), insider threat, or data protection technologies
• Hands-on experience with DLP tools (e.g., Forcepoint, Symantec, McAfee, Digital Guardian, Microsoft Purview, or other enterprise DLP solutions)
• Proven DLP administration skills: configuring policies, tuning detection rules, managing agents, generating reports, and performing incident investigations
• Strong understanding of data classification methodologies, sensitive data types (PII, PHI, PCI, IP, credentials), and regex/pattern matching for content inspection
• Experience with incident response processes, forensic investigation techniques, and security event escalation workflows
• Knowledge of compliance frameworks and regulations: GDPR, HIPAA, PCI-DSS, SOX, and their data protection requirements

Responsibilities

• Monitor and analyze DLP alerts across endpoint, browsers, SaaS, and AI applications to identify potential data exfiltration events, policy violations, and insider threats
• Conduct real-time triage of security alerts, distinguishing between true positives and false positives using behavioral context, data lineage analysis and sensitive findings
• Perform detailed forensic investigations into data loss incidents, analyzing user activity, data movement patterns, and exfiltration vectors (email, web uploads, removable storage, print, source code exfiltration, desktop apps, GenAI apps etc.)
• Understand and follow incident response processes and escalation procedures, coordinating with customer incident response teams on high‑severity cases
• Document investigation findings, evidence trails, and remediation recommendations with clear, actionable reports
• Configure and maintain DLP policies based on customer data classification schemes, compliance requirements (GDPR, HIPAA, PCI-DSS, SOX), and business objectives
• Continuously tune detection rules and sensitivity thresholds to reduce false positives while maintaining high detection accuracy
• Identify patterns in alert data to recommend new use cases, detection methods, and policy improvements
• Work with customers to develop custom detection policies for industry-specific sensitive data types and unique organizational requirements
• Establish baselines for normal user behavior by role, department, and geography to improve anomaly detection
• Serve as a trusted technical advisor and subject matter expert on data protection, DLP best practices, and insider threat management
• Conduct regular operational reviews with customers to share insights on data risk trends, policy effectiveness, and program maturity
• Educate customer security teams on using Nightfall’s platform effectively, including investigation workflows, reporting capabilities, onboarding and deployment best practices
• Understand customer business context to deliver relevant, actionable security guidance - not just alerts, but answers to “why this matters” and “what to do next”
• Administer Nightfall’s DLP solution including agent deployment, policy configuration, integration setup, and performance monitoring
• Troubleshoot technical issues with endpoint agents, browser extensions, SaaS integrations
• Work with Nightfall engineering teams to report bugs, provide product feedback, and contribute to feature development based on customer needs
• Stay current on Nightfall platform updates, new capabilities, and best practices to maximize value for customers
• Coordinate with internal teams (Sales Engineering, Customer Success, Product) to ensure successful customer outcomes
• Stay informed about emerging insider threat trends, data exfiltration techniques, and adversary tactics, techniques, and procedures (TTPs)
• Analyze external DLP market developments and competitive intelligence to inform customer guidance
• Contribute to Nightfall’s insider risk intelligence by documenting novel attack patterns, evasion techniques, and detection methods
• Compile and deliver executive-level reports with clear metrics, data visualizations, and risk assessments
• Track key performance indicators: detection accuracy, false positive rates, mean time to detect/respond, policy coverage, data at risk
• Provide business impact analysis showing how DLP program prevents data loss, supports compliance, and enables secure business operations
• Develop recommendations for continuous program improvement based on operational data and industry benchmarks

Skills

DLP knowledge

Data classification

Incident response

Forensic investigations

Regex/pattern matching

SaaS security

UEBA concepts

Python scripting

Threat intelligence

Education

Bachelor's degree in CS or related

Tools

Forcepoint

Symantec

McAfee

Microsoft Purview

Splunk

ELK

Job description

Nightfall AI is seeking a DLP Analyst to protect customer data across endpoints, SaaS, and GenAI tools. You will become an expert on Nightfall’s DLP platform, partnering with security teams to operationalize data loss prevention, investigate incidents, and advise on insider threat mitigation.

You’ll tune policies, monitor alerts, and deliver actionable reports while balancing technical precision with business context.