Data Protection & Certificate Services Analyst (DLP)

Job Title

Data Protection & Certificate Services Analyst (L2) – DLP (Purview), DSPM (BigID) & MS PKI

Role Summary

The L2 Data Protection & Certificate Services Analyst is responsible for advanced triage, investigation, and resolution of incidents and operational issues related to Data Loss Prevention (DLP) , Data Security Posture Management (DSPM) , and Microsoft PKI / Certificate Services for the client

This role handles issues escalated from L1 , performs deeper technical analysis, supports corrective actions, and escalates complex or systemic issues to L3 . The role operates in a 24×7 rotational shift model to support global data protection and encryption services.

In‑Scope Technologies

Data Loss Prevention (DLP)

Microsoft Purview DLP

Data Security Posture Management (DSPM)

BigID

Certificate & Encryption Services

Microsoft PKI / Active Directory Certificate Services (AD CS)

TLS/SSL certificate lifecycle support

Key Responsibilities (L2)

L2 DLP Incident Analysis & Resolution (Purview)

Handle DLP incidents escalated from L1, including:

DLP policy violations

Suspected data leakage events

Enforcement or reporting issues

Perform detailed analysis of DLP alerts to determine:

Validity of the violation

Affected users, endpoints, or cloud workloads

Business impact

Support policy tuning requests , false‑positive reduction, and corrective recommendations before escalation to L3 where required.

L2 DSPM Incident Handling & Data Risk Support (BigID)

Investigate BigID findings related to:

Sensitive data discovery

Misclassification or missing classification

Over‑permissioned access or data exposure

Troubleshoot data scan failures, connector issues, and partial visibility across data stores.

Coordinate with application, data, and platform teams to validate findings and support remediation actions.

Escalate complex DSPM issues or recurring patterns to L3.

L2 PKI / Certificate Services Support

Support L2 troubleshooting for Microsoft PKI (AD CS) issues, including:

Certificate issuance and renewal failures

Trust chain or intermediate CA issues

Certificate expiry or revocation warnings

Assist in identifying certificate‑related causes for:

Application authentication issues

Secure communication failures (TLS/SSL)

Escalate deep PKI or CA health issues to L3 with full technical context.

Cross‑Domain Incident Correlation

Correlate DLP and DSPM findings with:

Endpoint activity

Email events

Cloud security findings

Support investigations involving potential data exfiltration, mis‑handling of sensitive data, or encryption failures.

Operations, Documentation & Shift Handover

Maintain accurate and detailed incident records including:

Root cause analysis

Actions taken

Temporary or permanent resolutions

Participate in 24×7 shift rotations , including nights, weekends, and holidays.

Perform structured shift handovers, ensuring continuity of investigations and pending actions.

Adhere to SLAs, escalation matrices, and operational runbooks.

Required Skills & Experience

Mandatory

3–6+ years experience in Data Protection, DLP, Data Security, or Security Operations roles

Hands‑on operational experience with:

Microsoft Purview DLP

BigID DSPM

Microsoft PKI / AD CS

Strong understanding of:

Sensitive data handling and classification

Data leakage scenarios

Certificate lifecycle and trust models

Willingness to work in 24×7 shift operations

Preferred

Experience in regulated environments (healthcare, life sciences, financial services)

Experience working in SOC or managed security services environments

Exposure to audit and compliance support for data protection controls

Certifications (Preferred / Nice to Have)

Microsoft Purview / Information Protection certifications

Windows Server or PKI‑related certifications

Security+ or equivalent