Job Title: L1 Engineer – Forcepoint DLP & DSPM (In office Resident Engineer)

Experience: 2–4 years in IT Security / DLP Operations

Location: On-site (Client Location)

Shift: 24/7 rotational shift (as per SLA)

Key Responsibilities

1. Daily Operations & Monitoring

- Monitor Forcepoint DLP and DSPM consoles 24/7 for alerts, incidents, and system health
- Review daily dashboards, incident queues, and system performance metrics
- Perform routine health checks on DLP enforcers, endpoints, agents, and DSPM connectors
- Ensure zero missed SLA conditions for incident acknowledgment and resolution
- Execute daily backup of configuration files and logs; move backups to external storage

2. L1 Incident Response

- Handle first-line support for standard and low-complexity DLP/DSPM incident
- Triage alerts from DLP Engine: Endpoint, Network, Email, Web, Cloud, and DSP
- Acknowledge incidents within SLA and perform initial investigation
- Categorize and prioritize incidents based on severity (Critical, High, Medium, Low)
- Escalate complex issues to L2 Engineer with detailed notes and logs
- Update incident tickets with status, actions taken, and resolution details

3. Endpoint Agent Monitoring & Basic Troubleshooting

- Monitor Forcepoint Endpoint Agent health across Windows/Mac device
- Identify agents offline, communication failures, or policy sync issue
- Perform basic troubleshooting: restart agent, check connectivity, verify policy deploymen
- Document recurring issues and escalate persistent problems to L
- Assist with endpoint agent rollouts and uninstall/reinstall under L2 guidance

4. Policy & Classification Monitoring

- Monitor policy hits and false positives for DLP and DSPM classifiers
- Track endpoint classification events (MIP labels,



custom labels, sensitivity tags)
- Generate daily/weekly reports on:

Top incidents by category (USB, Email, Web, Print, Cloud

Policy hit trend

Endpoint agent status

DSPM data discovery result

5. Documentation & Reportin

- Maintain daily operation logs, incident logs, and escalation records
- Update knowledge base with common issues and resolution
- Prepare weekly status reports for client and internal management
- Document change requests and maintenance activities

6. Vendor & Stakeholder Coordination

- Communicate with Forcepoint support for severity-1/severity-2 escalation
- Coordinate with client IT teams for endpoint access, network connectivity, and AD sync issues
- Participate in daily stand-up meetings and shift handover

Requirements Education - B.E./B.Tech in IT/Computer Science or M CA

Experience

2–4 years in IT Security, preferably DLP/Endpoint Security operations

Technical Skills

- Basic knowledge of Forcepoint DLP (Endpoint, Network, Email, Web)
- Familiarity with Forcepoint DSPM concepts (data discovery, classification)
- Understanding of Active Directory, Windows/Mac endpoints, network ports
- Basic troubleshooting of agents, policies, and incidents
- Knowledge of DLP detection methods: Regex, Dictionary, Fingerprinting, OCR, Exact Data Matching ( EDM)

Tools Forcepoint Security Manager (FSM) or ONE Data Security portal

SIEM (Splunk/QRadar) for log viewing

ServiceNow/Jira for ticket management

VPN, remote access tools

Soft Skills

Strong communication ( verbal & written)

Ability to work in shifts

Detail-oriented, proactive, SLA-driven

Team player, willing to learn

Certifications (Preferred)

Forcepoint DLP training/certificat

Security+ / CEH /PCNSE (optional)

📌 Forcepoint DLP and Data Classification (DSPM) (Pune)
🏢 Amazure Technologies
📍 Pune