Information Protection & Security Operations Engineer

Description

This hybrid role is split roughly evenly between information protection and security operations.

Information protection work covers managing and improving Microsoft Purview controls, including Data Loss Prevention (DLP), Insider Risk Management and related data protection policies, so that sensitive data belonging to customers and to the company is protected without slowing people down.

Security operations work covers deploying, configuring, monitoring and maintaining security solutions, responding to incidents, and making sure vulnerabilities are found and fixed.

You will work with the IT team to build security and data protection into the wider infrastructure and help guard the IT estate and the company's data.

Responsibilities

• Information protection (about 50% of the role):
• Design, deploy and tune Microsoft Purview DLP policies across Exchange, SharePoint, OneDrive, Teams, endpoints and cloud apps.
• Configure and run Insider Risk Management, including policy templates, indicators, Adaptive Protection and case triage, working closely with HR, Legal and Compliance.
• Implement and maintain information classification, including sensitivity labels, label policies, auto-labeling and encryption.
• Manage related protection policies such as retention and records management, communication compliance, and Defender for Cloud Apps session and access policies.
• Monitor DLP and Insider Risk alerts, investigate policy matches, cut down false positives, and report on policy effectiveness and overall data protection posture.
• Define and document information protection standards, processes and runbooks, and support audits and compliance work such as ISO 27001, SOC 2, GDPR and NIS2.
• Drive user awareness and adoption through policy tips, guidance and training for business teams.
• Security operations (about 50% of the role):
• Deploy and configure security solutions, including intrusion detection systems and endpoint protection.
• Monitor security systems, triage alerts in Microsoft Defender XDR and Microsoft Sentinel, and respond to incidents.
• Investigate security incidents and build remediation plans.
• Run vulnerability assessments and coordinate fixes with infrastructure and application teams.
• Develop and put in place security policies and procedures.
• Build and improve detection rules, automation and playbooks to shorten response times.
• Give technical guidance and support to other IT professionals.

Requirements

• Information protection:
• Hands-on experience running Microsoft Purview DLP and Insider Risk Management in a production environment.
• Working knowledge of sensitivity labels, information classification, encryption and retention.
• Understanding of data protection and privacy regulations and frameworks, such as GDPR, ISO 27001 and NIS2, and how they become technical controls.
• Ability to balance security needs against user productivity, and to handle insider risk topics sensitively with HR, Legal and Compliance.
• Security operations:
• Knowledge of security technologies such as firewalls, intrusion detection systems and endpoint protection.
• Familiarity with networking and operating systems.
• Understanding of core security principles and best practices.
• Experience with SIEM and XDR tools, including KQL queries for investigation and detection.
• Ability to work calmly under pressure and respond to incidents quickly.
• Keep up with current CVEs and emerging threats, and track, assess and confirm coverage to protect the organization's security posture.
• General:
• Analytical and problem-solving skills.
• Clear communication and collaboration skills, including explaining data protection and security topics to non-technical stakeholders.
• Discretion and sound judgement when handling confidential and sensitive information.
• Education: a bachelor's degree in computer science, information technology, information security or a related field is typically required.
• Relevant certifications such as Microsoft SC-401, SC-200, AZ-500, CompTIA Security+ or CISSP may also be beneficial.
• Tools you may use include Microsoft Purview (DLP, Insider Risk Management, sensitivity labels, Data Lifecycle Management, Communication Compliance, Audit and eDiscovery), Microsoft Defender XDR (Defender for Endpoint, Office 365, Identity and Cloud Apps), Microsoft Sentinel, Microsoft Intune, Entra ID, Cisco ASA, Barracuda NGFW/WAF, Azure Firewall, Snort or Suricata, and Nessus or Qualys.

Conditions

Hybrid working model.

The company is committed to equal opportunity, and hiring decisions are based only on skills, qualifications and current business needs.

Benefits

• A culture built on trust and accountability, with freedom and autonomy to succeed and make an impact.
• Flexible Leave Paid Time Off policy, remote working options, and Global Wellbeing Days.
• Growth opportunities, with the tools and guidance to focus on what matters to you and do your best work.
• Working alongside talented colleagues, role models and mentors in the software industry.
• A commitment to sustainability, including an Environmental, Social, and Governance strategy and the Act4Good programme.
• A safe and inclusive workplace, supported by Employee Resource Groups open to all.