DLP, CASB & Access Security Analyst – 24/7 Operations

About the role

We are seeking experienced L1 & L2 DLP, CASB and Access Security Analysts to support a large enterprise customer in Qatar as part of a 24/7 security monitoring service focused on protecting sensitive information, monitoring cloud application activity and investigating suspicious or unauthorised access.

Key responsibilities

• Monitor, triage and investigate DLP, CASB, identity, privileged‑access and user‑activity alerts.
• Investigate data leakage, inappropriate file sharing, external transfers, mass downloads and removable‑media usage.
• Analyse activity across endpoints, cloud applications, identity platforms and access‑management systems.
• Investigate unusual authentication activity, excessive privileges and potential insider‑risk events.
• Monitor sanctioned and unsanctioned cloud applications using Microsoft Defender for Cloud Apps, Zscaler and related platforms.
• Correlate alerts with business context, data classifications, user roles and approved access to determine intent.
• Escalate confirmed incidents and support containment, remediation and access‑restriction actions.
• Maintain accurate investigation records, evidence, shift handovers and operational reports.
• Support policy tuning, dashboard development and continuous improvement of DLP, CASB and access‑security controls.

Required profile

• Experience in DLP, CASB, identity security, access monitoring or security operations.
• Understanding of data‑loss scenarios, cloud‑security risks and insider‑threat vectors.
• Knowledge of authentication, authorisation, privileged‑access and least‑privilege principles.
• Ability to analyse user, endpoint, application, identity and network activity.
• Familiarity with SIEM searches, log analysis and alert correlation.
• Strong analytical, investigation, documentation and communication skills.
• Professional handling of sensitive and confidential information.
• Willingness to work full‑time on‑site in Doha and participate in a 24/7 rotational shift schedule.

Required skills

• Microsoft Defender for Cloud Apps (formerly MCAS)
• Zscaler CASB, ZIA or ZPAM
• Microsoft Purview DLP and Information Protection
• Symantec, Forcepoint, Trellix or other enterprise DLP platforms
• Microsoft Sentinel or other SIEM platforms
• Microsoft Entra ID
• Xage Security
• CyberArk, BeyondTrust or Delinea privileged‑access platforms
• Microsoft Defender XDR or other endpoint‑security technologies