Job Description:
About Us
At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. Responsible Growth is how we run our company and how we deliver for our clients, teammates, communities and shareholders every day.
One of the keys to driving Responsible Growth is being a great place to work for our teammates around the world. We’re devoted to being a diverse and inclusive workplace for everyone. We hire individuals with a broad range of backgrounds and experiences and invest heavily in our teammates and their families by offering competitive benefits to support their physical, emotional, and financial well-being.
Bank of America believes both in the importance of working together and offering flexibility to our employees. We use a multi-faceted approach for flexibility, depending on the various roles in our organization.
Working at Bank of America will give you a great career with opportunities to learn, grow and make an impact, along with the power to make a difference. Join us!
Global Business Services
Global Business Services delivers Technology and Operations capabilities to Lines of Business and Staff Support Functions of Bank of America through a centrally managed, globally integrated delivery model and globally resilient operations.
Global Business Services is recognized for flawless execution, sound risk management, operational resiliency, operational excellence and innovation.
In India, we are present in five locations and operate as BA Continuum India Private Limited (BACI), a non-banking subsidiary of Bank of America Corporation and the operating company for India operations of Global Business Services.
Process Overview*
Global Information Security (GIS) is responsible for protecting Bank information systems, confidential and proprietary data, and customer information. The team develops the Bank’s Information Security strategy and policy, manages the Information Security program and identifies and addresses vulnerabilities, Develops, deploys and manages a risk-based controls portfolio, Manages and operates global security operations center that monitors, detects and responds to cybersecurity incidents
Job Description*
We are seeking a highly motivated and technically skilled Data Loss Prevention (DLP) to join the Cyber Security Operations team. This role will be responsible for understanding the enterprise DLP strategy, policy enforcement, threat detection, investigation, and response activities across on-premises, cloud, and endpoint environments.
The ideal candidate will possess deep expertise in DLP technologies, information protection, insider risk management, cloud security, and detection engineering. In addition, the candidate should have hands-on experience leveraging AI/ML-driven security analytics, automation, and orchestration capabilities to improve detection accuracy, reduce operational overhead, and strengthen the bank's overall data protection posture.
As a senior member of the team, you will provide technical leadership, guide junior analysts, drive strategic security initiatives, enhance monitoring capabilities, and collaborate with cross-functional stakeholders to ensure protection of sensitive data across the enterprise
Responsibilities*
Data Loss Prevention & Information Protection
- Serve as the primary SME for enterprise DLP technologies, policies, controls, and monitoring capabilities.
- Design, implement, tune, and maintain DLP controls across endpoint, network, email, web, SaaS applications, and cloud environments.
- Lead investigations involving data exfiltration, insider threats, unauthorized disclosures, and policy violations.
- Develop and optimize detection use cases for sensitive data protection, insider risk monitoring, and regulatory compliance requirements.
- Partner with business, technology, and risk teams to identify data protection risks and implement appropriate controls.
- Security Monitoring, Detection & Response
- Operate within the end-to-end detection and response lifecycle (Detect → Investigate → Respond → Improve).
- Conduct advanced investigations utilizing SIEM, EDR/XDR, DLP, Cloud Security, Identity Security, and Threat Intelligence platforms.
- Analyze logs, events, and telemetry from multiple security sources to determine attack scope, root cause, business impact, and remediation requirements.
- Lead security incident response activities involving DLP violations, cloud security incidents, insider threats, and data exposure events.
- Develop and continuously improve detection content aligned with MITRE ATT&CK tactics, techniques, and procedures (TTPs).
- Cloud Security (AWS & Azure)
- Design and monitor DLP and data protection controls across multi-cloud environments including AWS and Microsoft Azure.
- Support implementation and management of cloud-native security solutions, including:
- AWS GuardDuty
- AWS Macie
- AWS Security Hub
- AWS CloudTrail
- Microsoft Defender for Cloud
- Microsoft Purview Information Protection & DLP
- Microsoft Sentinel
- Azure Monitor and Azure Security Center
- Investigate cloud-based threats involving sensitive data exposure, excessive permissions, misconfigurations, and unauthorized access.
- Develop cloud security monitoring and detection use cases to enhance visibility and protection across cloud workloads and SaaS platforms.
AI/ML-Driven DLP & Security Analytics
- Leverage Artificial Intelligence and Machine Learning capabilities to improve DLP effectiveness, classification accuracy, insider risk detection, and threat identification.
- Develop and implement behavioral analytics and anomaly detection models for identifying malicious or accidental data leakage.
- Utilize Generative AI and advanced analytics capabilities to enhance incident triage, threat enrichment, investigation workflows, and response effectiveness.
- Collaborate with engineering teams to integrate AI/ML solutions into DLP monitoring, detection, and response processes.
- Measure and drive improvements in detection quality, false-positive reduction, and operational efficiency through AI-driven capabilities.
Security Automation & Orchestration
- Design and enhance automated response workflows using SOAR platforms.
- Develop scripting and API-based integrations to automate repetitive response and remediation tasks.
- Improve operational effectiveness by reducing Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
- Maintain automated playbooks and response mechanisms supporting DLP, cybersecurity, and cloud security operations.
Leadership & Continuous Improvement
- Provide technical mentorship and guidance to junior analysts and operational teams.
- Drive security process improvements and operational maturity initiatives.
- Develop metrics, dashboards, and reporting related to DLP effectiveness, incident response, and cloud security posture.
- Communicate findings and recommendations effectively to both technical and executive-level stakeholders.
Requirements*
Education* B.E. / B. Tech/M.E. /M. Tech/B.Sc./M.Sc./BCA/MCA (prefer IT/CS specialization)
Certifications If Any: CEH, Cloud Certifications, Security+, CCNA or any equivalent
Experience Range* 8-10+Years
Foundational Skills*
- 10 + years of experience in Information Security, Security Operations, DLP Operations, Incident Response, Detection Engineering, or related cybersecurity functions.
- Deep expertise in Data Loss Prevention (DLP) technologies and controls.
- Hands-on experience with one or more of:
- Microsoft Purview DLP
- Symantec DLP
- Forcepoint DLP
- Palo Alto Enterprise DLP
- Digital Guardian
- Strong understanding of data classification, information protection, insider risk, and regulatory compliance requirements.
- Experience investigating and responding to DLP incidents across endpoint, network, email, cloud, and SaaS environments.
- Strong experience with SIEM and Security Analytics platforms:
- Microsoft Sentinel
- Splunk
- QRadar
- Elastic
- Proficiency in: KQL ,SQL ,Python and PowerShell
- Experience with SOAR platforms, automation, orchestration, and API integrations.
- Strong understanding of MITRE ATT&CK framework and cyber adversary TTPs.
- Extensive hands-on experience securing and monitoring AWS and Azure environments.
- Experience with cloud-native security tools including AWS Macie, GuardDuty, Security Hub, Defender for Cloud, and Microsoft Purview.
- Experience leveraging AI/ML capabilities for security analytics, user behavior analytics (UBA), anomaly detection, insider threat detection, or predictive risk analysis.
- Demonstrated track record of reducing alert noise, improving detection coverage, improving MTTR, and enhancing operational effectiveness.
- Promotes awareness of current and emerging cybersecurity threats and advises on potential information security exposure
- Assesses and mitigates cyber security risks related to application, network, infrastructure, and public cloud
- Interprets the information security requirements outlined in policies, standards, and procedures and reinforces requirements through education and awareness
- Supports teammates who serve as “security ambassadors” in order to help partners drive strategic and innovative risk mitigation priorities and navigate the GIS organization
Desired Skills*
- Exceptional communication and executive presence, with the ability to influence at all organizational levels
- Experience implementing AI-driven DLP and Insider Risk Management programs.
- Experience with User and Entity Behavior Analytics (UEBA).
- Familiarity with Large Language Models (LLMs), Generative AI security controls, and AI governance frameworks.
- Knowledge of Zero Trust Architecture and Data Security Posture Management (DSPM).
- Executive-level communication and stakeholder management skills.
- Experience leading geographically distributed cybersecurity teams.
- Strong problem-solving and decision-making abilities.
- Experience supporting enterprise-scale digital transformation and cloud migration initiatives.
Work Timings* 11:30am to 08:30pm IST
Job Location: Mumbai, Chennai
