Lead Specialist InfoSecOps - Data Loss Prevention (DLP)

About the Role

This role leads the Data Loss Prevention (DLP) service delivery for a client organization, overseeing protection across endpoints, network, email, Microsoft 365, cloud/SaaS, and business workflow environments. The lead specialist is tasked with designing DLP policy frameworks, managing governance, supervising incident responses, tuning policies for accuracy, managing exceptions, and collaborating closely with stakeholders to measurably reduce data leakage risk without hindering business operations.

Key Responsibilities

• Drive end-to-end DLP service management utilizing Forcepoint DLP and Microsoft Purview to protect endpoint, network, email, and cloud traffic.
• Convert business process requirements, regulatory mandates, and data classification needs into effective DLP policies and enforcement rules.
• Architect and govern detection rules employing sensitive data types, regular expressions, keywords, dictionaries, fingerprinting, EDM/IDM, and label-aware controls.
• Set risk-aligned enforcement strategies ranging from monitoring and user coaching to quarantine and blocking, ensuring phased, reversible deployment.
• Analyze DLP incidents, prioritize critical cases, ensure high investigation standards, and coordinate corrective actions with data owners and other stakeholders.
• Lead analyses of false positives and false negatives, refining policies to enhance precision and minimize impact on business productivity.
• Administer DLP exception handling through comprehensive justification documentation, business approvals, compensating controls, expiration tracking, and periodic revalidation.
• Collaborate with Legal, Privacy, HR, IT, application owners, and business units to facilitate policy implementation, conduct investigations, and raise user awareness.
• Ensure seamless integration of DLP with SIEM/SOAR, ITSM, CASB/SWG, data classification, DRM platforms, and incident handling procedures.
• Maintain operational health covering service status, connector and endpoint agent coverage, policy deployments, and backlog management.
• Generate detailed operational metrics daily and weekly, monthly business reports, and quarterly executive summaries focusing on incidents, tuning activities, exceptions, and risk mitigation outcomes.
• Keep meticulous audit-ready documentation including evidence, policy versions, testing records, approvals, incident logs, and remediation tracking.
• Provide mentorship to DLP engineers and ensure technical excellence in policy development and incident investigations.

Required Skills and Certifications

• Formal training and expertise as a Forcepoint DLP Administrator or Professional.
• Certification as a Microsoft Information Protection Administrator (SC-400).
• Preferred certifications include CISSP, CISM, or CISA, with additional advantage for CDPSE or privacy/data protection qualifications.
• ITIL Foundation certification is an added benefit.
• Strong written and oral communication abilities.
• Excellent analytical, problem-solving skills with strict attention to detail and quality control.
• Strong sense of accountability and ownership of tasks.
• Effective teamwork skills and ability to collaborate with a variety of stakeholders.

Experience and Education Requirements

• At least 7 years in information security roles, including minimum 5 years managing enterprise-level DLP or data protection systems.
• A bachelor's degree in Computer Science, Cybersecurity, Information Technology, Information Systems, Engineering, or a closely related field is mandatory.
• Postgraduate qualification in information or cybersecurity is advantageous.