JD For DLP (L1) (1-3 years):-

- Perform initial investigation steps: collect logs, review event context, identify affected users/data, document timeline.
- Validate alerts: classify true positives vs false positives, assign severity and impact.
- Perform initial investigation steps: collect logs, review event context, identify affected users/data, document timeline.
- Apply standard playbooks and response procedures; contain incidents where applicable

(e.g., block, quarantine, revoke access) under supervision.
- Escalate confirmed incidents to L2/L3 and incident response teams with explicit, welldocumented findings.
- Support periodic rule tuning, whitelist management, and false positive reduction under guidance.
- Assist with user communication templates for incident notifications and remediation instructions.
- Participate in scheduled reviews, reporting, and metrics generation (alert volumes, MTTR,

false positive rates).

Preferred qualifications

- Exposure to one or more DLP products (Symantec DLP, Forcepoint DLP, Microsoft

Purview DLP, Netskope, or McAfee/Trellix).
- Experience/Knowledge with regulatory frameworks (GDPR, HIPAA, ISO 27001) and data privacy basics.

JD For DLP (L2) (3-5 years):-

- Create,



modify, and optimize DLP policies using EDM (Exact Data Match), IDM (Indexed

Document Match), regex, and classification labels.
- Analyze recurring false positives, refine matching criteria, and apply exceptions/whitelists without exposing sensitive data to risk.
- Perform health checks, patch updates, and agent troubleshooting across Endpoint, Network,

Web Proxy, and Cloud DLP components.
- Receive escalated incidents from Tier 1 (SOC/Service Desk), perform root-cause analysis, and evaluate intent (accidental misuse vs. malicious exfiltration)
- Work with HR, Legal, Compliance, and the broader Incident Response team on high-risk policy violations or potential insider threats.
- Protect data movement across Removable Media, Email (SMTP), Web/CASB, Printers,

Clipboard, and Cloud Storage (O365, Google Workspace).

Preferred qualifications

- Exposure to one or more DLP products (Symantec DLP, Forcepoint DLP, Microsoft

Purview DLP, Netskope, or McAfee/Trellix).
- Experience/Knowledge with regulatory frameworks (GDPR, HIPAA, ISO 27001) and data privacy basics.

📌 Data Loss Prevention Engineer (Gurugram)
🏢 Care Health Insurance
📍 Gurugram