Data Protection Analyst

About the Role

We are seeking a meticulous and operationally focused Data Protection & Insider Risk Analyst to join our Information Security team. This position involves continuous monitoring and thorough review of Data Loss Prevention (DLP) alerts and insider-risk indicators to safeguard both CBIZ and client sensitive data. The Analyst will identify unauthorized dissemination, transfers, or mishandling of confidential information, documenting findings and escalating issues as appropriate.

Key Responsibilities

• Monitor DLP alerts related to confidential client and company data across various channels such as email, chat, files, and approved collaboration platforms.
• Examine alerts triggered by data sent to non-approved destinations including personal emails and cloud storage.
• Detect and assess activities attempting to move, retain, or disclose sensitive information outside authorized systems and processes.
• Analyze activities where sensitivity labels or data-protection controls might have been altered before external sharing.
• Evaluate indicators of potential insider risk, including recurrent external data transfers, unusual data volumes, handling of sensitive client files, use of personal accounts, and suspicious file manipulations.
• Collect, document, and preserve key alert information such as user identity, timestamps, data types, sensitivity levels, involved files or messages, triggered policies, and justification for escalation.
• Promptly escalate high-risk or suspicious activities to the Data Protection team following established playbooks and timelines.
• Assist in reviewing additional security alerts like suspicious user behavior and policy breaches.
• Maintain detailed case notes, alert logs, and generate metrics regarding reviewed alerts, escalations, false positives, and recurring trends.
• Identify trends in false positives and suggest policy adjustments to enhance DLP alert quality and reduce unnecessary manual reviews.

Preferred Qualifications

• Bachelor's degree in Information Systems, Cybersecurity, Business, Risk, Compliance, Criminal Justice, or related fields; or equivalent experience.
• At least three years of experience in security operations, DLP, insider-risk monitoring, compliance, fraud detection, audit support, privacy, or risk-related analytical roles.
• Basic knowledge of handling sensitive and confidential information securely.
• Understanding of data classification standards and sensitivity labeling such as Public, Internal, Confidential, Restricted, and client-confidential categories.
• Familiarity with platforms like email, chat, file sharing, and collaboration tools, and the risks involved with data transfer to personal or unauthorized destinations.
• Excellent attention to detail with strong ability to recognize unusual or risky behavioral patterns.
• Proficient in clear and concise written communications and documentation, capable of preparing factual case notes.
• Demonstrates high standards of integrity, professionalism, and confidentiality when managing sensitive data.
• Ability to independently follow procedures, handle repetitive tasks, and meet response and escalation deadlines.

Training and Role Boundaries

Training will be provided on relevant DLP and insider-risk monitoring tools, CBIZ’s data classification and sensitivity labeling, data handling practices, alert triage protocols, documentation standards, and escalation criteria.

The Analyst’s scope involves identifying and escalating risks but excludes independently judging employee intent, communicating directly with employees about alerts, making disciplinary decisions, or closing high-risk cases. Formal investigations and coordination with Legal, HR, Compliance, or management will be conducted by designated teams.