DLP Specialist (Data Loss Prevention)

Sasso Consulting; Centurion; On-site; ZAR 800,000 - 1,000,000; Full time

Job summary

Sasso Consulting is seeking experienced DLP specialists to implement, configure and monitor enterprise DLP controls across endpoints, networks and cloud apps. You will protect sensitive information, develop protection policies and investigate data-exposure incidents to prevent loss.

Ideal candidates have hands-on DLP experience, strong data classification knowledge and a collaborative approach with cybersecurity operations for continuous improvement.

Qualifications

• Diploma or degree in IT/CS/cybersecurity or related field.
• 3–5 years hands-on experience in enterprise DLP administration.
• Experience implementing and administering enterprise DLP technologies.
• Strong knowledge of data classification and information protection.

Responsibilities

• Implement, configure, administer and maintain enterprise DLP platforms.
• Deploy DLP controls across endpoints, networks, cloud apps and data repositories.
• Develop and tune DLP policies, detection rules and enforcement actions.
• Investigate DLP alerts, incidents and data exposure events.
• Collaborate with security teams to integrate DLP with SIEM and other tools.

Skills

Data Loss Prevention

Policy development

Incident investigation

Endpoint security

DLP administration

Data classification

Information protection

Security operations

Education

Relevant IT/CS degree

Tools

Microsoft Purview DLP

Broadcom Symantec DLP

Forcepoint DLP

Job description

Data Loss Prevention (DLP) Specialist

Location: Centurion, Gauteng (provisional – to be confirmed)
Positions Available: 5
Salary: Market-related
Employment Type: To be confirmed

Job Overview

We are seeking experienced and technically proficient Data Loss Prevention (DLP) Specialists to implement, configure, administer, monitor and continuously improve enterprise data loss prevention technologies and information protection controls.

The successful candidates will be responsible for protecting sensitive, confidential and business-critical information against unauthorised disclosure, accidental exposure, inappropriate sharing and data exfiltration across enterprise endpoints, networks, email systems, cloud applications and data repositories.

This role requires strong hands‑on expertise in enterprise DLP solutions, data classification, information protection policies, sensitive data discovery, security incident investigation and the implementation of technical controls designed to prevent data leakage.

The ideal candidates will have proven experience administering enterprise DLP platforms, developing and optimising data protection policies, investigating DLP incidents and integrating information protection technologies with broader cybersecurity operations.

Candidates must demonstrate practical technical experience in enterprise data loss prevention rather than general information security awareness or policy administration alone.

Key Responsibilities

Enterprise DLP Implementation and Administration

• Implement, configure, administer and maintain enterprise Data Loss Prevention platforms.
• Deploy and manage DLP controls across endpoints, email systems, networks, cloud applications and supported data repositories.
• Configure and maintain DLP policies, detection rules and enforcement actions.
• Administer centralised DLP management consoles and monitoring dashboards.
• Configure DLP detection mechanisms for sensitive information and confidential business data.
• Maintain DLP platform availability, performance and operational effectiveness.
• Support upgrades, migrations, patching and technical improvements to DLP technologies.
• Troubleshoot DLP agent, connector, policy and platform issues.
• Integrate DLP solutions with enterprise infrastructure and security technologies.
• Ensure consistent application of data protection controls across the organisation.

Data Classification and Information Protection

• Support the identification and classification of sensitive organisational information.
• Configure data classification labels and information protection policies.
• Implement controls for confidential, restricted and regulated information.
• Develop DLP policies based on data sensitivity, business requirements and risk.
• Configure sensitive information types, classification rules and detection patterns.
• Implement protection controls for personally identified information, financial information and intellectual property.
• Support automated and manual data classification processes.
• Collaborate with data owners, compliance teams and business stakeholders to define appropriate protection requirements.
• Review and improve data classification and protection controls.
• Maintain documentation of data protection policies and classification standards.

Endpoint Data Loss Prevention

• Implement and manage endpoint DLP technologies across enterprise workstations and supported devices.
• Configure policies controlling the movement and sharing of sensitive information.
• Monitor and restrict unauthorised copying of sensitive data to removable storage.
• Configure controls for printing, clipboard activities, file transfers and other supported endpoint actions.
• Monitor sensitive information movement through approved and unapproved applications.
• Investigate endpoint DLP alerts and suspected data leakage.
• Manage endpoint DLP agents and associated security configurations.
• Troubleshoot endpoint DLP enforcement and compatibility issues.
• Support endpoint data protection across hybrid and remote-working environments.
• Review endpoint DLP policy effectiveness and recommend improvements.

Email, Network and Cloud DLP

• Implement and maintain DLP controls for enterprise email systems.
• Configure policies to detect and prevent unauthorised transmission of sensitive information.
• Support DLP monitoring for Microsoft Exchange Online, Microsoft 365 and other relevant email platforms.
• Implement information protection controls for SharePoint, OneDrive and supported collaboration platforms.
• Configure cloud application DLP policies and data‑sharing restrictions.
• Monitor potentially unauthorised uploads, downloads and transfers of sensitive information.
• Support integration with Cloud Access Security Broker (CASB) and Security Service Edge (SSE) technologies where applicable.
• Configure network DLP controls where supported by the selected platform.
• Investigate suspected data exfiltration through email, web, cloud and network channels.
• Collaborate with cloud, network and security teams to strengthen data protection.

DLP Policy Development and Optimisation

• Develop and maintain DLP policies aligned with organisational information protection requirements.
• Configure sensitive information detection rules, regular expressions and classification-based conditions.
• Implement policy actions including monitoring, user notifications, blocking and incident escalation.
• Test DLP policies before enterprise deployment.
• Investigate and reduce false‑positive and false‑negative detections.
• Manage approved exceptions and policy exclusions through appropriate governance processes.
• Review policy effectiveness and recommend improvements.
• Balance data protection requirements with legitimate business operations.
• Maintain version‑controlled policy documentation where appropriate.
• Support continuous improvement of enterprise data protection controls.

DLP Incident Monitoring and Investigation

• Monitor DLP alerts, policy violations and suspected data leakage incidents.
• Investigate potentially unauthorised handling, sharing or transmission of sensitive information.
• Analyse DLP event logs and associated security telemetry.
• Determine the nature, severity and potential impact of suspected data exposure.
• Distinguish genuine data security incidents from legitimate business activity.
• Escalate significant incidents to information security, incident response, privacy or compliance teams.
• Support investigations involving potential insider threats and data exfiltration.
• Preserve relevant investigation evidence in accordance with organisational procedures.
• Recommend remediation measures and improvements to data protection controls.
• Maintain accurate DLP incident records and investigation reports.

Sensitive Data Discovery and Risk Assessment

• Support the discovery of sensitive information across enterprise systems and repositories.
• Identify data stored or shared in locations that may not meet organisational protection requirements.
• Analyse data exposure risks associated with endpoints, email, cloud services and file repositories.
• Assist with identifying inappropriate access or sharing permissions.
• Support data protection assessments and information security reviews.
• Recommend technical controls to reduce the risk of unauthorised data disclosure.
• Collaborate with data governance and infrastructure teams to improve sensitive data visibility.
• Monitor recurring data protection weaknesses and policy violations.

Security Integration and Automation

• Integrate DLP technologies with SIEM, SOAR and other enterprise security platforms where supported.
• Configure DLP event forwarding and security monitoring integrations.
• Support automated DLP incident notifications, escalation and remediation workflows.
• Integrate DLP controls with identity and access management technologies.
• Support integration with endpoint security, cloud security and information protection platforms.
• Develop operational dashboards and data protection reporting.
• Use scripting and automation to improve DLP administration and reporting.
• Troubleshoot technical integration issues.
• Collaborate with SOC analysts and incident responders on suspected data exfiltration incidents.

Governance, Risk and Regulatory Compliance

• Support alignment of DLP controls with organisational information security policies.
• Assist with technical data protection requirements arising from applicable legislation and industry standards.
• Support data protection measures relevant to South Africa's Protection of Personal Information Act (POPIA), where applicable.
• Maintain appropriate records of DLP policies, controls and incident handling.
• Support internal and external security audits.
• Provide evidence of data protection control implementation and effectiveness.
• Collaborate with legal, privacy, risk and compliance stakeholders.
• Recommend improvements to technical information protection controls.
• Support awareness initiatives relating to secure handling of sensitive information.

Minimum Requirements

• Relevant diploma or degree in Information Technology, Computer Science, Cybersecurity, Information Security, Information Systems or a related discipline.
• Typically 3-5 years of relevant hands‑on experience in enterprise DLP administration, information protection engineering, data security or a closely related technical specialisation.
• Proven practical experience implementing, configuring or administering enterprise Data Loss Prevention technologies.
• Strong understanding of sensitive data protection, information classification and data leakage risks.
• Experience developing, configuring and maintaining DLP policies and detection rules.
• Practical experience investigating DLP alerts, policy violations and suspected data exposure incidents.
• Experience with endpoint, email, cloud or network DLP controls.
• Understanding of data classification, sensitive information types and information protection labels.
• Familiarity with enterprise identity and access management technologies.
• Good understanding of Microsoft 365, Windows endpoints and enterprise collaboration platforms.
• Experience troubleshooting DLP platform, policy and enforcement issues.
• Knowledge of data exfiltration techniques and information security threats.
• Understanding of information security governance and regulatory compliance requirements.
• Strong analytical, investigative and technical problem‑solving skills.
• Experience with Microsoft Purview DLP, Broadcom Symantec DLP, Forcepoint DLP or equivalent enterprise technologies would be highly relevant.

Technical Skills and Competencies

Enterprise DLP Platforms

Practical experience with one or more of the following technologies:

• Microsoft Purview Data Loss Prevention
• Microsoft Purview Information Protection
• Broadcom Symantec Data Loss Prevention
• Forcepoint Data Loss Prevention
• Trellix Data Loss Prevention
• Netskope DLP
• Zscaler Data Protection
• Palo Alto Networks Enterprise DLP
• Digital Guardian DLP
• Other recognised enterprise DLP platforms

DLP Policy Configuration and Administration

• Enterprise DLP implementation
• DLP policy development
• Sensitive information detection
• Policy conditions and enforcement actions
• Endpoint DLP configuration
• Email DLP configuration
• Cloud DLP administration
• Network DLP fundamentals
• DLP alert management
• Policy testing and tuning
• False‑positive reduction
• DLP exceptions and exclusions
• Centralised DLP console administration
• DLP platform troubleshooting
• DLP upgrades and migrations

Data Classification and Information Protection

• Data classification
• Information sensitivity labels
• Sensitive information types
• Exact Data Match (EDM)
• Regular expressions
• Keyword and pattern matching
• Document fingerprinting
• Data discovery
• Data protection policies
• Information Rights Management fundamentals
• Microsoft Purview sensitivity labels
• Microsoft Purview Information Protection
• Data lifecycle and retention fundamentals

Endpoint Data Protection

• Endpoint DLP agents
• Removable media controls
• USB data transfer restrictions
• Clipboard and printing controls
• File transfer monitoring
• Browser upload restrictions
• Endpoint security policy enforcement
• Windows endpoint security
• Microsoft Intune integration
• Endpoint DLP incident investigation

Microsoft 365 and Cloud Data Protection

• Microsoft Purview
• Microsoft 365
• Exchange Online
• SharePoint Online
• OneDrive for Business
• Microsoft Teams information protection
• Microsoft Entra ID
• Microsoft Defender for Cloud Apps
• Cloud application data protection
• Cloud sharing controls
• Cloud Access Security Broker (CASB) fundamentals
• SaaS data protection
• Hybrid data security

DLP Monitoring and Incident Investigation

• DLP event analysis
• Data leakage investigation
• Data exfiltration indicators
• Insider risk indicators
• Sensitive information exposure
• Security incident triage
• DLP incident escalation
• Audit log analysis
• Incident evidence handling
• Security event correlation
• Remediation tracking
• Data protection reporting

Enterprise Security Integration

• SIEM integration
• Microsoft Sentinel
• Splunk
• IBM QRadar
• Security event forwarding
• SOAR integration
• Microsoft Defender XDR
• Endpoint security technologies
• Identity and Access Management
• Active Directory
• Microsoft Entra ID
• Enterprise security monitoring
• API integration

Scripting and Automation

• PowerShell
• Python fundamentals
• REST APIs
• JSON
• Regular expressions
• Security administration automation
• DLP reporting automation
• Microsoft Graph API fundamentals
• Data analysis and reporting

Cybersecurity Frameworks and Standards

• POPIA
• ISO/IEC 27001
• ISO/IEC 27002
• NIST Cybersecurity Framework
• CIS Critical Security Controls
• Data governance principles
• Information classification standards
• Privacy and data protection controls
• Security incident management procedures

Relevant Certifications (Advantageous)

One or more of the following certifications would be beneficial:

• Microsoft Certified: Information Security Administrator Associate (SC-401)
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• CompTIA Security+
• CompTIA CySA+
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified Information Privacy Professional (CIPP)
• Certified Information Privacy Manager (CIPM)
• Relevant Microsoft Purview certifications or training
• Broadcom Symantec DLP certifications or training
• Forcepoint DLP certifications or training
• Netskope or Zscaler data protection certifications
• Other recognised enterprise DLP or information protection certifications

Key Personal Attributes

• Strong technical and analytical problem‑solving abilities.
• Excellent attention to detail and security policy accuracy.
• Strong understanding of confidentiality and sensitive information protection.
• Ability to investigate complex data security incidents.
• Practical approach to balancing data protection and legitimate business requirements.
• Strong troubleshooting and technical investigation skills.
• Excellent communication and stakeholder engagement abilities.
• Ability to collaborate with cybersecurity, infrastructure, legal, privacy and compliance teams.
• Strong organisational and documentation skills.
• Proactive approach to identifying data security weaknesses.
• High levels of confidentiality, accountability and professional integrity.

Application Requirements

• Enterprise DLP platforms they have personally implemented, configured or administered.
• Experience with Microsoft Purview, Symantec DLP, Forcepoint DLP or equivalent technologies.
• DLP policies and detection rules they have developed and maintained.
• Experience implementing endpoint, email, network and cloud DLP controls.
• Data classification and information protection technologies used.
• Experience investigating DLP incidents and suspected data exfiltration.
• Microsoft 365, SharePoint, OneDrive and Exchange Online data protection experience.
• DLP policy tuning, false‑positive reduction and exception management.
• Experience integrating DLP platforms with SIEM or other security technologies.
• DLP implementation, migration or optimisation projects completed.
• The size and complexity of enterprise data protection environments supported.
• Relevant DLP, information protection and cybersecurity certifications.

Important: This is a specialist Data Loss Prevention opportunity requiring demonstrable hands‑on experience implementing, configuring and administering enterprise DLP technologies. General IT support, information security governance or compliance experience without substantial practical DLP engineering or administration experience will not be sufficient.