The DLP Operations Analyst plays a critical role in the organization's Cybersecurity Incident Detection and Response function. This role is primarily responsible for monitoring, triaging, investigating, and responding to Data Loss Prevention (DLP) alerts and incidents across multiple channels and platforms. The analyst will also manage day-to-day operational tasks, support business units during incident investigations, and collaborate with internal teams to strengthen the organization’s data protection posture.
 

Position Responsibilities:
 

Alert Monitoring & Incident Response

• Monitor and triage DLP alerts from various platforms (email, web, endpoint, cloud, etc.).
• Conduct detailed investigations of potential data loss incidents, including root cause analysis and impact assessment.
• Escalate confirmed or high-risk incidents to appropriate cybersecurity teams and assist in breach investigations.
• Collaborate with business units and stakeholders to support incident containment, remediation, and post-incident reviews.
• Gather and analyze logs, evidence, and other relevant data to support incident investigations.
   

Operational Support & BAU Activities

• Handle DLP-related ServiceNow tickets, including:
  • Service Requests (e.g., access requests, policy inquiries),
  • Break/Fix Incidents (e.g., tool malfunctions, alert delivery issues),
  • Security Incidents (e.g., confirmed or suspected data exfiltration).
• Maintain operational workflows and ensure timely resolution of tickets.
   

Stakeholder Engagement & Collaboration

• Act as a liaison between Cybersecurity, Business Units, Legal, HR, and other stakeholders during incident investigations.
• Facilitate cross-functional collaboration to ensure effective incident response and remediation.
• Support partner Cyber teams in gathering evidence and performing forensic analysis as needed.
   

DLP Policy & Coverage Enhancement

• Work closely with the DLP Engineering team to:
  • Recommend improvements to detection logic and alert fidelity.
  • Assist in provisioning and expanding coverage of new Sensitive Information Types.
  • Provide feedback based on operational insights to enhance policy effectiveness.
     

Incident Review & Process Improvement

• Perform regular analysis of DLP incidents to identify trends, recurring issues, and gaps in detection.
• Contribute to continuous improvement initiatives aimed at reducing false positives and enhancing response efficiency.
• Document lessons learned and propose updates to operational playbooks and workflows.
   

Reporting & Analytics (Good to Have)

• Build and maintain dashboards using Power BI to visualize DLP metrics, incident trends, and operational KPIs.
• Use Kusto Query Language (KQL) and Azure Data Explorer (ADX) to create custom queries for data analysis and reporting.
   

Qualifications

• Experience in DLP alert triage, incident investigation, and operational support.
• Familiarity with ServiceNow or similar ticketing systems.
• Strong understanding of data protection principles and cybersecurity incident response processes.
• Excellent communication and collaboration skills for working with cross-functional teams.
• Experience with Power BI and KQL is a plus.
• Amenable to work in UP Ayala Technohub (Quezon City)
• Amenable to work in a hybrid set-up (3x onsite per week)
• Amenable to work in a rotating shift schedule assigned

When you join our team:

• We’ll empower you to learn and grow the career you want.
• We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words.
• As part of our global team, we’ll support you in shaping the future you want to see.

About Manulife and John Hancock

Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html.

Manulife is an Equal Opportunity Employer

At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.

It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact [email protected].

Hybrid