Security Analyst IV – DLP Monitoring & Response

CSAA Insurance Group; Phoenix (AZ); Remote; USD 120,000 - 155,000; Full time

Job summary

CSAA Insurance Group is seeking a Security Analyst IV to monitor and respond to enterprise DLP events across cloud and on-premise environments. You will analyze alerts, assess data exposure risks, coordinate incident response, and work with stakeholders to protect sensitive information.

Ideal candidates have 7+ years in security operations, hands-on DLP/CASB experience, and familiarity with Purview, MDCA, Netskope, Macie, or Trellix.

Qualifications

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or related field (or equivalent).
• 7+ years in cybersecurity, security operations, incident response, DLP, CASB, cloud security, or data protection.
• Hands-on experience investigating and responding to security or DLP alerts in an enterprise environment.
• Experience with one or more DLP/CASB platforms such as Purview, MDCA, Netskope, Macie, or Trellix.
• Familiarity with cloud collaboration platforms and data sharing technologies.
• Knowledge of regulatory/compliance requirements (PCI, GDPR, CCPA, HIPAA) and security best practices.

Responsibilities

• Monitor, investigate, and triage DLP/data protection alerts across multiple security platforms.
• Analyze events to determine risk, business impact, and remediation actions.
• Escalate high-risk events following incident response procedures.
• Document investigations, findings, and remediation recommendations.
• Collaborate with Cyber Defense, IT, Cloud, Privacy, Legal, and Compliance teams.
• Develop metrics, dashboards, and reporting for leadership.

Skills

DLP monitoring

Incident response

Cloud security

Security operations

SIEM

Education

Bachelor’s degree

Tools

Microsoft Purview

MDCA

Netskope

AWS Macie

Trellix

Splunk

Job description

External candidates: In order for your application to be correctly processed please sign-in before you applyInternal candidates: Please go to Workday and click \"Find Jobs\" link under CareerThank you for considering opportunities with us!Job TitleSecurity Analyst IV – DLP Monitoring & ResponseRequisition NumberR7862 Security Analyst IV – DLP Monitoring & Response (Open)LocationArizona - Home TeleworkersAdditional LocationsAlabama - Home Teleworkers, Alabama - Home Teleworkers, Arkansas - Home Teleworkers, California - Home Teleworkers, Colorado - Home Teleworkers, Connecticut - Home Teleworkers, Delaware - Home Teleworker, District of Columbia - Home Teleworkers, Florida - Home Teleworkers, Georgia - Home Teleworkers, Idaho - Home Teleworkers, Illinois - Home Teleworkers, Indiana - Home Teleworkers, Iowa - Home Teleworkers, Kansas - Home Teleworker, Kentucky - Home Teleworkers, Louisiana - Home Teleworkers, Maine Home Teleworkers, Maryland - Home Teleworkers, Massachusetts - Home Teleworkers, Michigan - Home Teleworkers, Minnesota - Home Teleworkers, Mississippi - Home Teleworker, Missouri - Home Teleworker, Montana - Home Teleworkers {+ 21 more}Job InformationCSAA Insurance Group (CSAA IG), a AAA insurer, is one of the leading personal lines property and casualty insurance groups in the United States. Here, every employee shapes our mission. We build innovative, human-centered solutions that help AAA members prevent, prepare for, and recover from life's uncertainties. You will join a collaborative, inclusive culture where your strengths have room to grow and your ideas can drive real impact. Step into a role where you can contribute to our shared success through meaningful work.We are actively hiring for a Security Analyst IV – DLP Monitoring & ResponseYour Role: We are seeking an experienced Security Analyst IV to support enterprise Data Loss Prevention (DLP) operations through event monitoring, investigation, triage, and risk assessment across cloud and on-premises environments. This role will be responsible for analyzing DLP alerts, identifying potential data exposure risks, coordinating incident response activities, and working with stakeholders across the organization to protect sensitive information. This role is critical to protecting the organization's sensitive data by ensuring timely detection, investigation, and response to potential data protection risks. The Security Analyst IV will help strengthen our data security posture, improve operational effectiveness, and support the continued evolution of DLP capabilities across the enterprise.Your Work: The ideal candidate has strong experience in cybersecurity operations, DLP technologies, cloud security, and incident response, with the ability to collaborate effectively across technical and business teams.Tools & PlatformsMicrosoft Purview DLPMicrosoft Defender for Cloud Apps (MDCA)Netskope DLP/CASBAWS MacieTrellix DLPAkamaiWizSIEM and security monitoring platforms, primarily Tines and SplunkKey ResponsibilitiesDLP Monitoring & Incident TriageMonitor, investigate, and triage DLP and data protection alerts across multiple security platforms.Analyze events to determine risk, business impact, and appropriate remediation actions.Escalate high-risk events in accordance with established incident response procedures.Document investigations, findings, and remediation recommendations.Risk Assessment & Data ProtectionIdentify potential data exposure, unauthorized sharing, and data exfiltration risks.Validate alerts and distinguish true positives from false positives.Support risk-based prioritization of security events and incidents.Ensure alignment with corporate security policies and regulatory requirements.Collaboration & Stakeholder EngagementPartner with Cyber Defense, Security Engineering, IT, Cloud, Privacy, Legal, Compliance, and business teams.Work with data owners and stakeholders to validate business context and support remediation efforts.Communicate findings and recommendations to both technical and non-technical audiences.Continuous ImprovementIdentify recurring trends, policy gaps, and tuning opportunities.Support DLP policy optimization, detection improvements, and automation initiatives.Contribute to operational playbooks, procedures, and knowledge-sharing efforts.Assist in developing metrics, dashboards, and reporting for leadership.Required Experience, Education and SkillsBachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related field or equivalent practical experience (may be considered in place of a bachelor’s degree).7+ years of experience in cybersecurity, security operations, incident response, DLP, CASB, cloud security, or data protection.Hands-on experience investigating and responding to security or DLP alerts in an enterprise environment.Experience working with one or more DLP/CASB platforms such as Microsoft Purview, MDCA, Netskope, AWS Macie, or Trellix.Familiarity with cloud collaboration platforms and data sharing technologies.Technical SkillsUnderstanding of DLP concepts, data classification, and information protection controls.Knowledge of incident response processes and security event investigations.Experience with cloud security technologies and SaaS applications.Familiarity with SIEM tools, dashboards, and security reporting.Working knowledge of regulatory and compliance requirements such as PCI, GDPR, CCPA, HIPAA, or similar frameworks.Years’ of experienceWhat would make us excited about you?Actively shapes our company culture (e.g., participating in employee resource groups, volunteering, etc.)Lives into cultural norms (e.g., willing to have cameras when it matters: helping onboard new team members, building relationships, etc.)Travels as needed for role, including divisional / team meetings and other in-person meetingsFulfills business needs, which may include investing extra time, helping other teams, etcCISSPCISMSecurity+CEHMicrosoft Security CertificationsNetskope CertificationsAWS Security CertificationsPlease note we are hiring for this role remote anywhere in the United States with the following exceptions: Hawaii and Alaska.Why Choose a Career at CSAA IG?At CSAA IG, we are a mission-driven organization proudly committed to empowering our members, our employees, and our communities to thrive.Recognition: We offer a total compensation package, annual bonus eligibility for most roles, 401(k) with a company match, and so much more! Read more about what we offer and what it is like to be a part of our dynamic team at https://careers.csaainsurance.aaa.com/us/en/benefits.Career Growth: We believe in growth for everyone. Here at CSAA IG, leaders and mentors partner with employees to align interests, unlock development opportunities, and support long‑term success.Flexible Workplace: We embrace a remote-first culture through our Flexible Workplace. Most employees hold Home-Flex roles, working primarily from home, often with the flexibility to work from various locations including CSAA offices. Our flexible workplace empowers you to balance remote work with intentional in‑person moments that deepen connection and collaboration.Inclusion and Belonging: An inclusive and welcoming workplace is the cornerstone of our success. By fostering an environment where people feel valued and heard, we deepen our ability to understand and meet the unique needs of our members. This strengthens innovation and enhances our products and services, giving us a competitive edge in the market.Sustainability: As climate change leads to more frequent and severe weather events, we are taking bold action to build more resilient communities and reduce our environmental impact. Submit your application to be considered. We communicate via email, so check your inbox and/or your spam folder to ensure you don’t miss important updates from us.CSAA is committed to providing reasonable accommodations to qualified applicants and employees with disabilities or other limitations. If you would like to request an accommodation to participate in the job application or interview process, please contact [e-mail] you apply and are selected to continue in the recruiting process, we will schedule a preliminary call with you to discuss the role and will disclose during that call the available salary/hourly rate range based on your location. Factors used to determine the actual salary offered may include location, experience, or education.CSAA does not provide visa sponsorship for this role. Applicants must have authorization to work indefinitely in the US. Please do not apply for this role if at any time (now or in the future) you will need immigration support (i.e., H-1B, TN, STEM OPT Training Plans, etc.).CSAA Insurance Group is an equal opportunity employer.#LI-SB1The national average salary range for this position is $116,820.00-$129,800.00. However, we have a location-based compensation structure. Our salary ranges vary and are calculated based on work location. The starting pay range for this position across all the states we hire in is $116,820.00-$155,750.00. This role also includes an opportunity for a company-wide annual discretionary bonus, through our Annual Incentive Plan (AIP), of up to 10% of eligible pay.Colorado Specific Job Range :$116,820.00 - $142,800.00This job posting will be unposted on Fri, 30 Oct 2026.