DLP, CASB & Access Security Analyst – 24/7 Operations

About the role

We are looking for experienced L1 & L2 DLP, CASB and Access Security Analysts to join a 24/7 security monitoring service for a large enterprise client in Doha. The role involves protecting sensitive data, monitoring cloud applications and investigating suspicious access events.

Key responsibilities

• Monitor, triage and investigate DLP, CASB, identity, privileged‑access and user‑activity alerts.
• Investigate data leakage, inappropriate file sharing, external transfers, mass downloads and removable‑media usage.
• Analyse activity across endpoints, cloud applications, identity platforms and access‑management systems.
• Investigate unusual authentication activity, excessive privileges and potential insider‑risk events.
• Monitor sanctioned and unsanctioned cloud applications using Microsoft Defender for Cloud Apps, Zscaler and related platforms.
• Correlate alerts with business context, data classifications, user roles and approved access.
• Escalate confirmed incidents and support containment, remediation and access‑restriction activities.
• Maintain accurate investigation records, evidence, shift handovers and operational reports.
• Support policy tuning, dashboard development and continuous improvement of DLP, CASB and access‑security controls.

Required profile

• Experience in DLP, CASB, identity security, access monitoring or security operations.
• Understanding of data‑loss scenarios, cloud‑security risks, insider threats and inappropriate data handling.
• Knowledge of authentication, authorisation, privileged‑access and least‑privilege principles.
• Ability to analyse user, endpoint, application, identity and network activity.
• Familiarity with SIEM searches and incident investigation processes.

Required skills

• Microsoft Defender for Cloud Apps (formerly MCAS)
• Zscaler CASB, ZIA or ZPAM
• Microsoft Purview DLP and Information Protection
• Symantec, Forcepoint, Trellix or other enterprise DLP platforms
• Microsoft Sentinel or other SIEM platforms
• Microsoft Entra ID
• Xage Security
• CyberArk, BeyondTrust, Delinea or other privileged‑access platforms
• Microsoft Defender XDR or other endpoint‑security technologies