Job Title: Data Protection & Insider Risk Analyst

Department: Information Security

Reports To: Manager, AI Security & Data Protection

Position Summary:

The Data Protection & Insider Risk Analyst is an operational, detail-oriented role responsible for monitoring and reviewing Data Loss Prevention (DLP), insider-risk, and related security alerts. The role helps protect CBIZ and client information by identifying potential unauthorized sharing, removal, or mishandling of confidential and sensitive data.

The Analyst performs first-level alert review, gathers and documents relevant evidence, identifies potential risk indicators, and promptly escalates qualified cases to the Data Protection team for formal investigation. This role requires sound judgment, discretion, robust documentation skills, and the ability to handle sensitive information on a strict need-to-know basis. Training will be provided on CBIZ tools, policies, data classification, sensitivity labels, and investigation and escalation procedures.

Roles & Responsibilities:

- Monitor and review DLP alerts involving CBIZ, client, confidential, and sensitive information across email, chat, files, attachments, and approved collaboration platforms.
- Review alerts involving data sent to personal email accounts, personal cloud storage, or other unapproved external destinations.
- Identify potential attempts to move, retain, remove, or disclose sensitive information outside approved CBIZ systems and business processes.
- Review activities in which a user may have changed, removed, or reduced a sensitivity label or other data-protection control before sharing information externally.
- Assess alerts for indicators of possible insider risk, including repeated external transfers, unusual data volumes, sensitive client files, personal accounts,



compressed or renamed files, and activity inconsistent with an employees normal business need.
- Gather, preserve, and document relevant alert details, including user, date and time, source and destination, data type, sensitivity label, files or messages involved, policy triggered, and concise rationale for escalation.
- Escalate high-risk, suspicious, or policy-violating activity to the Data Protection team in accordance with defined playbooks and service-level expectations.
- Support review of other security alerts and potential threats assigned, including suspicious user behavior, policy violations, and data-handling concerns.
- Maintain accurate case notes, alert trackers, metrics, and reporting for alerts reviewed, escalations, false positives, true positives, aged incidents, and recurring trends.
- Identify recurring false positives, common benign business scenarios, and policy-tuning opportunities that can improve DLP alert quality and reduce unnecessary manual review.

Preferred Qualifications:

- Degree in Information Systems, Cybersecurity, Business, Risk, Compliance, Criminal Justice, or a related field; or an equivalent combination of education and relevant experience.
- 13 years of experience in security operations, DLP, insider-risk monitoring, compliance operations, fraud monitoring, audit support, privacy, risk operations, or a related analytical role.




- Foundational understanding of sensitive, confidential, and client information and the importance of secure data handling.
- Familiarity with data classification and sensitivity labels, such as Public, Internal, Confidential, Restricted, and client-confidential information.
- Familiarity with email, chat, file-sharing, and collaboration platforms, including the risks associated with sending business information to personal accounts or unapproved destinations.
- Strong attention to detail and pattern-recognition skills, with the ability to identify unusual or potentially risky behavior.
- Strong written communication and documentation skills, including the ability to prepare concise, factual, and well-organized case notes.
- High degree of integrity, professionalism, and discretion when handling sensitive employee, company, and client information.
- Ability to follow defined procedures, work independently, manage repetitive alert-review activities, and meet established response and escalation timelines.

Training and Role Boundaries: CBIZ will provide training on DLP and insider-risk monitoring tools, CBIZ data-classification standards, sensitivity labels, data-handling requirements, alert-review procedures, evidence documentation, and escalation thresholds.

This role is responsible for identifying, documenting, and escalating potential risk. The Analyst will not independently determine employee intent, contact employees regarding alerts, make disciplinary recommendations, or close high-risk insider-risk cases without direction from the Data Protection team. Formal investigations and coordination with Legal, Human Resources, Compliance, or management will be handled by the appropriate CBIZ teams.

📌 Data Protection Analyst (Bengaluru)
🏢 SAPRO
📍 Bengaluru