DLP & CASB L2 Engineer

Experience- 4+ years

Job Responsibilities-

Review and validate DLP and CASB alerts escalated by L1 analysts.

Investigate potential data exfiltration, misuse, or policy violations across email, endpoint, and web channels.

Escalate confirmed incidents to L3 SMEs or Incident Response teams with detailed context and evidence

Collaborate with DLP / CASB SMEs to fine-tune detection rules and reduce false positives.

Implement rule changes based on business requirements (typically 10–50 per month for CASB)

Support policy lifecycle management, including testing, deployment, and rollback procedures.

Monitor the operational health of DLP and CASB platforms (e.g., Forcepoint, Netskope).

Ensure integration with SIEM and ticketing systems is functioning correctly.

Coordinate with OEMs and platform teams for patching, upgrades, and troubleshooting

Maintain incident logs, RCA documentation, and policy change records.

Contribute to monthly dashboards and SLA / KPI reporting for DLP / CASB operations

Participate in governance reviews and client-facing reporting sessions.

Work closely with L1 monitoring teams to guide triage and escalation practices.

Support cross-skilling initiatives and contribute to SOP development

Participate in threat modelling and use case development for data protection.