Security Analyst IV – DLP Monitoring & Response

External candidates: In order for your application to be correctly processed please sign-in before you apply

Internal candidates: Please go to Workday and click "Find Jobs" link under Career

Thank you for considering opportunities with us!

Job Title

Security Analyst IV – DLP Monitoring & Response

Requisition Number

R7862 Security Analyst IV – DLP Monitoring & Response (Open)

Location

Arizona - Home Teleworkers

Additional Locations

Alabama - Home Teleworkers, Alabama - Home Teleworkers, Arkansas - Home Teleworkers, California - Home Teleworkers, Colorado - Home Teleworkers, Connecticut - Home Teleworkers, Delaware - Home Teleworker, District of Columbia - Home Teleworkers, Florida - Home Teleworkers, Georgia - Home Teleworkers, Idaho - Home Teleworkers, Illinois - Home Teleworkers, Indiana - Home Teleworkers, Iowa - Home Teleworkers, Kansas - Home Teleworker, Kentucky - Home Teleworkers, Louisiana - Home Teleworkers, Maine Home Teleworkers, Maryland - Home Teleworkers, Massachusetts - Home Teleworkers, Michigan - Home Teleworkers, Minnesota - Home Teleworkers, Mississippi - Home Teleworker, Missouri - Home Teleworker, Montana - Home Teleworkers {+ 21 more}

Job Information

CSAA Insurance Group (CSAA IG), a AAA insurer, is one of the leading personal lines property and casualty insurance groups in the United States. Here, every employee shapes our mission. We build innovative, human-centered solutions that help AAA members prevent, prepare for, and recover from life's uncertainties. You will join a collaborative, inclusive culture where your strengths have room to grow and your ideas can drive real impact. Step into a role where you can contribute to our shared success through meaningful work.

We are actively hiring for a Security Analyst IV – DLP Monitoring & Response

Your Role: We are seeking an experienced Security Analyst IV to support enterprise Data Loss Prevention (DLP) operations through event monitoring, investigation, triage, and risk assessment across cloud and on-premises environments. This role will be responsible for analyzing DLP alerts, identifying potential data exposure risks, coordinating incident response activities, and working with stakeholders across the organization to protect sensitive information. This role is critical to protecting the organization's sensitive data by ensuring timely detection, investigation, and response to potential data protection risks. The Security Analyst IV will help strengthen our data security posture, improve operational effectiveness, and support the continued evolution of DLP capabilities across the enterprise.

Your Work: The ideal candidate has strong experience in cybersecurity operations, DLP technologies, cloud security, and incident response, with the ability to collaborate effectively across technical and business teams.

Tools & Platforms

• Microsoft Purview DLP

• Microsoft Defender for Cloud Apps (MDCA)

• Netskope DLP/CASB

• AWS Macie

• Trellix DLP

• Akamai

• Wiz

• SIEM and security monitoring platforms, primarily Tines and Splunk

Key Responsibilities

DLP Monitoring & Incident Triage

• Monitor, investigate, and triage DLP and data protection alerts across multiple security platforms.

• Analyze events to determine risk, business impact, and appropriate remediation actions.

• Escalate high-risk events in accordance with established incident response procedures.

• Document investigations, findings, and remediation recommendations.

Risk Assessment & Data Protection

• Identify potential data exposure, unauthorized sharing, and data exfiltration risks.

• Validate alerts and distinguish true positives from false positives.

• Support risk-based prioritization of security events and incidents.

• Ensure alignment with corporate security policies and regulatory requirements.

Collaboration & Stakeholder Engagement

• Partner with Cyber Defense, Security Engineering, IT, Cloud, Privacy, Legal, Compliance, and business teams.

• Work with data owners and stakeholders to validate business context and support remediation efforts.

• Communicate findings and recommendations to both technical and non-technical audiences.

Continuous Improvement

• Identify recurring trends, policy gaps, and tuning opportunities.

• Support DLP policy optimization, detection improvements,