We never ask for payment as part of our selection process, and we always contact candidates via our corporate accounts and platforms. If you are approached for payment, this is likely to be fraudulent. Please check to see whether the role you are interested in is posted here, on our website.

About TMF Group

TMF Group is a leading global provider of high-value business services to clients operating and investing globally. We focus on providing specialized and business-critical financial and administrative services that enable our clients to operate their corporate structures, finance vehicles and investment funds in different geographical locations.

TMF India is a Great Place to Work, ISO & ISAE certified organization.

Discover the Role

The DLP Operations Lead is responsible for leading the day-to-day operation and effectiveness of the Data Loss Prevention service. The role ensures that DLP alerts and incidents are consistently monitored, triaged, investigated, escalated and closed in line with approved procedures and risk priorities. It also provides operational governance, reporting, quality assurance and stakeholder coordination across the DLP lifecycle.

This is an operations leadership role. It does not own routine administration, engineering or technical management of the DLP platform.

Key Responsibilities

Lead daily DLP monitoring and incident operations, ensuring appropriate coverage, prioritisation and workload allocation.
Oversee alert triage, investigation, evidence review, escalation, containment coordination and case closure.
Ensure DLP incidents are handled according to approved procedures, severity criteria, service targets and risk-based priorities.
Provide guidance on complex, sensitive or high-risk DLP cases and coordinate required input from relevant business and control functions.
Maintain operational quality through case reviews, sampling, peer review and coaching of DLP analysts.
Identify recurring data-loss patterns, control gaps and process weaknesses, and translate them into clear improvement actions.
Monitor operational performance, backlog, ageing, escalation quality, false-positive trends and closure quality.
Prepare concise operational dashboards, management updates and risk-based insights for Information Security leadership.
Maintain and improve DLP operating procedures, playbooks, escalation paths, investigation standards and case documentation requirements.
Coordinate DLP operational readiness for new or changed policies, ensuring analysts understand the detection intent, expected triage approach and escalation requirements.
Manage operational hand-offs with the DLP administration or engineering team where rule changes, platform fixes or technical configuration are required.
Support audits, control assessments and assurance reviews by providing operational evidence, case records, metrics and process walkthroughs.
Lead operational reviews following significant incidents and track agreed corrective actions to completion.
Promote consistent handling across regions while recognising applicable business, legal or regulatory constraints communicated by the relevant owners.

Team leadership:

Provide day-to-day direction, prioritisation and subject-matter guidance to DLP operations analysts.
Define clear operational responsibilities, shift or coverage expectations, escalation routes and quality standards.
Coach team members on investigation techniques, evidence quality, stakeholder communication and risk-based decision-making.
Coordinate leave and coverage planning to maintain appropriate monitoring and response capability.
Foster a collaborative, accountable and continuous-improvement culture within DLP operations

Key Requirements

Stakeholder engagement:

Act as the primary operational contact for DLP incidents and service performance matters.
Work with Security Operations, HR, Legal, Privacy, Compliance and business stakeholders according to defined roles and escalation requirements.
Communicate incident facts, risk, required actions and operational constraints clearly and proportionately.
Ensure ownership boundaries are clear, particularly where action is required from platform administrators, infrastructure teams or business owners.

Experience and qualifications:

Bachelor’s degree in information security, Cybersecurity, Computer Science or a related discipline, or equivalent practical experience.
Substantial experience in information security operations, including hands-on involvement in DLP alert monitoring and incident investigation.
Experience leading or coordinating an operational security team or service.
Strong understanding of data-loss scenarios across email, endpoint, web, cloud and collaboration channels from an operational monitoring perspective.
Experience with incident management, case documentation, escalation, root-cause analysis and corrective-action tracking.
Ability to interpret DLP events in business context and make proportionate, risk-based decisions.
Experience producing operational metrics and communicating trends, risks and service issues to management.
Knowledge of data classification, information handling requirements and relevant security or compliance frameworks.
Excellent written and verbal communication skills, with the ability to handle sensitive matters professionally.

Core competencies

Operational leadership and sound judgement
Risk-based prioritisation and decision-making
Incident investigation and analytical thinking
Quality assurance and attention to detail
Clear stakeholder communication
Process ownership and continuous improvement
Confidentiality, integrity and professional discretion

Success measures:

Timely and risk-aligned handling of DLP alerts and incidents.
Consistent investigation quality, evidence standards and case closure.
Controlled backlog and appropriate escalation of high-risk matters.
Reduced repeat issues through actionable trend analysis and follow-through.
Clear, accurate and decision-useful operational reporting.
Well-maintained procedures, playbooks and team readiness.
Effective coordination with technical owners without transferring platform administration into the operations role.

What’s in it for you?

Pathways for career development

Work with colleagues and clients around the world on interesting and challenging work.
We provide internal career opportunities, so you can take your career further within TMF.
Continuous development is supported through global learning opportunities from the TMF Business Academy.

Making an impact

You’ll be helping us to make the world a simpler place to do business for our clients.
Through our corporate social responsibility program, you’ll also be making a difference in the communities where we work.

A supportive environment

Strong feedback culture to help build an engaging workplace.
Regardless of where you are in your career, TMF Group opens a world of opportunity where you will be part of our team and is supported in your global career journey.
Our inclusive work environment allows you to work from our offices around the world, as well as from home, helping you find the right work-life balance to perform at your best.
At TMF Group, it’s our people who make us who we are. Our company thrives on entrepreneurial spirit and is full of proactive people who combine enthusiasm with responsibility and accountability.

Other Benefits

Anniversary & Birthday Leave policy
Be part of One TMF
Paternity & Adoption leaves
Salary advance policy
Work flexibility – Hybrid work model
Talk about growth opportunities (we invest in talent)
Well-being initiatives

We’re looking forward to getting to know you!

Lead - Information Security

Start with your email