We never ask for payment as part of our selection process, and we always contact candidates via our corporate accounts and platforms. If you are approached for payment, this is likely to be fraudulent. Please check to see whether the role you are interested in is posted here, on our website.
About TMF Group
TMF Group is a leading global provider of high-value business services to clients operating and investing globally. We focus on providing specialized and business-critical financial and administrative services that enable our clients to operate their corporate structures, finance vehicles and investment funds in different geographical locations.
TMF India is a Great Place to Work, ISO & ISAE certified organization.
Discover the Role
The DLP Operations Lead is responsible for leading the day-to-day operation and effectiveness of the Data Loss Prevention service. The role ensures that DLP alerts and incidents are consistently monitored, triaged, investigated, escalated and closed in line with approved procedures and risk priorities. It also provides operational governance, reporting, quality assurance and stakeholder coordination across the DLP lifecycle.
This is an operations leadership role. It does not own routine administration, engineering or technical management of the DLP platform.
Key Responsibilities
- Lead daily DLP monitoring and incident operations, ensuring appropriate coverage, prioritisation and workload allocation.
- Oversee alert triage, investigation, evidence review, escalation, containment coordination and case closure.
- Ensure DLP incidents are handled according to approved procedures, severity criteria, service targets and risk-based priorities.
- Provide guidance on complex, sensitive or high-risk DLP cases and coordinate required input from relevant business and control functions.
- Maintain operational quality through case reviews, sampling, peer review and coaching of DLP analysts.
- Identify recurring data-loss patterns, control gaps and process weaknesses, and translate them into clear improvement actions.
- Monitor operational performance, backlog, ageing, escalation quality, false-positive trends and closure quality.
- Prepare concise operational dashboards, management updates and risk-based insights for Information Security leadership.
- Maintain and improve DLP operating procedures, playbooks, escalation paths, investigation standards and case documentation requirements.
- Coordinate DLP operational readiness for new or changed policies, ensuring analysts understand the detection intent, expected triage approach and escalation requirements.
- Manage operational hand-offs with the DLP administration or engineering team where rule changes, platform fixes or technical configuration are required.
- Support audits, control assessments and assurance reviews by providing operational evidence, case records, metrics and process walkthroughs.
- Lead operational reviews following significant incidents and track agreed corrective actions to completion.
- Promote consistent handling across regions while recognising applicable business, legal or regulatory constraints communicated by the relevant owners.
Team leadership:
- Provide day-to-day direction, prioritisation and subject-matter guidance to DLP operations analysts.
- Define clear operational responsibilities, shift or coverage expectations, escalation routes and quality standards.
- Coach team members on investigation techniques, evidence quality, stakeholder communication and risk-based decision-making.
- Coordinate leave and coverage planning to maintain appropriate monitoring and response capability.
- Foster a collaborative, accountable and continuous-improvement culture within DLP operations
Key Requirements
Stakeholder engagement:
- Act as the primary operational contact for DLP incidents and service performance matters.
- Work with Security Operations, HR, Legal, Privacy, Compliance and business stakeholders according to defined roles and escalation requirements.
- Communicate incident facts, risk, required actions and operational constraints clearly and proportionately.
- Ensure ownership boundaries are clear, particularly where action is required from platform administrators, infrastructure teams or business owners.
Experience and qualifications:
- Bachelor’s degree in information security, Cybersecurity, Computer Science or a related discipline, or equivalent practical experience.
- Substantial experience in information security operations, including hands-on involvement in DLP alert monitoring and incident investigation.
- Experience leading or coordinating an operational security team or service.
- Strong understanding of data-loss scenarios across email, endpoint, web, cloud and collaboration channels from an operational monitoring perspective.
- Experience with incident management, case documentation, escalation, root-cause analysis and corrective-action tracking.
- Ability to interpret DLP events in business context and make proportionate, risk-based decisions.
- Experience producing operational metrics and communicating trends, risks and service issues to management.
- Knowledge of data classification, information handling requirements and relevant security or compliance frameworks.
- Excellent written and verbal communication skills, with the ability to handle sensitive matters professionally.
Core competencies
- Operational leadership and sound judgement
- Risk-based prioritisation and decision-making
- Incident investigation and analytical thinking
- Quality assurance and attention to detail
- Clear stakeholder communication
- Process ownership and continuous improvement
- Confidentiality, integrity and professional discretion
Success measures:
- Timely and risk-aligned handling of DLP alerts and incidents.
- Consistent investigation quality, evidence standards and case closure.
- Controlled backlog and appropriate escalation of high-risk matters.
- Reduced repeat issues through actionable trend analysis and follow-through.
- Clear, accurate and decision-useful operational reporting.
- Well-maintained procedures, playbooks and team readiness.
- Effective coordination with technical owners without transferring platform administration into the operations role.
What’s in it for you?
Pathways for career development
- Work with colleagues and clients around the world on interesting and challenging work.
- We provide internal career opportunities, so you can take your career further within TMF.
- Continuous development is supported through global learning opportunities from the TMF Business Academy.
Making an impact
- You’ll be helping us to make the world a simpler place to do business for our clients.
- Through our corporate social responsibility program, you’ll also be making a difference in the communities where we work.
A supportive environment
- Strong feedback culture to help build an engaging workplace.
- Regardless of where you are in your career, TMF Group opens a world of opportunity where you will be part of our team and is supported in your global career journey.
- Our inclusive work environment allows you to work from our offices around the world, as well as from home, helping you find the right work-life balance to perform at your best.
- At TMF Group, it’s our people who make us who we are. Our company thrives on entrepreneurial spirit and is full of proactive people who combine enthusiasm with responsibility and accountability.
Other Benefits
- Anniversary & Birthday Leave policy
- Be part of One TMF
- Paternity & Adoption leaves
- Salary advance policy
- Work flexibility – Hybrid work model
- Talk about growth opportunities (we invest in talent)
- Well-being initiatives
We’re looking forward to getting to know you!