Lead - Information Security

TMF Group is a leading global provider of high-value business services to clients operating and investing globally. We focus on providing specialized and business-critical financial and administrative services that enable our clients to operate their corporate structures, finance vehicles and investment funds in different geographical locations.

TMF India is a Great Place to Work, ISO & ISAE certified organization.

The DLP Operations Lead is responsible for leading the day-to-day operation and effectiveness of the Data Loss Prevention service. The role ensures that DLP alerts and incidents are consistently monitored, triaged, investigated, escalated and closed in line with approved procedures and risk priorities. It also provides operational governance, reporting, quality assurance and stakeholder coordination across the DLP lifecycle.

This is an operations leadership role. It does not own routine administration, engineering or technical management of the DLP platform.

• Lead daily DLP monitoring and incident operations, ensuring appropriate coverage, prioritisation and workload allocation.
• Oversee alert triage, investigation, evidence review, escalation, containment coordination and case closure.
• Ensure DLP incidents are handled according to approved procedures, severity criteria, service targets and risk-based priorities.
• Provide guidance on complex, sensitive or high-risk DLP cases and coordinate required input from relevant business and control functions.
• Maintain operational quality through case reviews, sampling, peer review and coaching of DLP analysts.
• Identify recurring data-loss patterns, control gaps and process weaknesses, and translate them into clear improvement actions.
• Monitor operational performance, backlog, ageing, escalation quality, false-positive trends and closure quality.
• Prepare concise operational dashboards, management updates and risk-based insights for Information Security leadership.
• Maintain and improve DLP operating procedures, playbooks, escalation paths, investigation standards and case documentation requirements.
• Coordinate DLP operational readiness for new or changed policies, ensuring analysts understand the detection intent, expected triage approach and escalation requirements.
• Manage operational hand-offs with the DLP administration or engineering team where rule changes, platform fixes or technical configuration are required.
• Support audits, control assessments and assurance reviews by providing operational evidence, case records, metrics and process walkthroughs.
• Lead operational reviews following significant incidents and track agreed corrective actions to completion.
• Promote consistent handling across regions while recognising applicable business, legal or regulatory constraints communicated by the relevant owners.

Team leadership:

• Provide day-to-day direction, prioritisation and subject-matter guidance to DLP operations analysts.
• Define clear operational responsibilities, shift or coverage expectations, escalation routes and quality standards.
• Coach team members on investigation techniques, evidence quality, stakeholder communication and risk-based decision-making.
• Coordinate leave and coverage planning to maintain appropriate monitoring and response capability.
• Foster a collaborative, accountable and continuous-improvement culture within DLP operations

Stakeholder engagement:

• Act as the primary operational contact for DLP incidents and service performance matters.
• Work with Security Operations, HR, Legal, Privacy, Compliance and business stakeholders according to defined roles and escalation requirements.
• Communicate incident facts, risk, required actions and operational constraints clearly and proportionately.
• Ensure ownership boundaries are clear, particularly where action is required from platform administrators, infrastructure teams or business owners.

Experience and qualifications:

• Bachelor’s degree in information security, Cybersecurity, Computer Science or a related discipline, or equivalent practical experience.
• Substantial experience in information security operations, including hands-on involvement in DLP alert monitoring and incident investigation.
• Experience leading or coordinating an operational security team or service.
• Strong understanding of data-loss scenarios across email, endpoint, web, cloud and collaboration channels from an operational monitoring perspective.
• Experience with incident management, case documentation, escalation, root-cause analysis and corrective-action tracking.
• Ability to interpret DLP events in business context and make proportionate, risk-based decisions.
• Experience producing operational metrics and communicating trends, risks and service issues to management.
• Knowledge of data classification, information handling requirements and relevant security or compliance frameworks.
• Excellent written and verbal communication skills, with the ability to handle sensitive matters professionally.

Core competencies

• Operational leadership and sound judgement
• Risk-based prioritisation and decision-making
• Incident investigation and analytical thinking
• Quality assurance and attention to detail
• Clear stakeholder communication
• Process ownership and continuous improvement
• Confidentiality, integrity and professional discretion

Success measures:

• Timely and risk-aligned handling of DLP alerts and incidents.
• Consistent investigation quality, evidence standards and case closure.
• Controlled backlog and appropriate escalation of high-risk matters.
• Reduced repeat issues through actionable trend analysis and follow-through.
• Clear, accurate and decision-useful operational reporting.
• Well-maintained procedures, playbooks and team readiness.
• Effective coordination with technical owners without transferring platform administration into the operations role.

Pathways for career development 

Making an impact 

A supportive environment 

Other Benefits