Information Protection & Security Operations Engineer

Description

This hybrid role is split roughly evenly between information protection and security operations.

Information protection work centres on Microsoft Purview controls, including Data Loss Prevention (DLP) and Insider Risk Management, so that sensitive data belonging to customers and to the company is protected without slowing people down.

Security operations work covers deploying, configuring, monitoring and maintaining security solutions, responding to incidents and making sure vulnerabilities are found and fixed.

You will work with IT colleagues to build security and data protection into the organisation's infrastructure and look after the IT estate and the data it holds.

Responsibilities

• Information protection (about 50% of the role):
• Design, deploy and tune Microsoft Purview DLP policies across Exchange, SharePoint, OneDrive, Teams, endpoints and cloud apps.
• Configure and run Insider Risk Management, including policy templates, indicators, Adaptive Protection and case triage, working closely with HR, Legal and Compliance.
• Implement and maintain information classification, covering sensitivity labels, label policies, auto-labelling and encryption.
• Manage related protection policies, including retention and records management, communication compliance, and Defender for Cloud Apps session and access policies.
• Monitor DLP and Insider Risk alerts, investigate policy matches, cut down false positives, and report on policy effectiveness and overall data protection posture.
• Define and document information protection standards, processes and runbooks, and support audits and compliance work such as ISO 27001, SOC 2, GDPR and NIS2.
• Drive user awareness and adoption through policy tips, guidance and training for business teams.
• Security operations (about 50% of the role):
• Deploy and configure security solutions, including intrusion detection systems and endpoint protection.
• Monitor security systems, triage alerts in Microsoft Defender XDR and Microsoft Sentinel, and respond to incidents.
• Investigate security incidents and build remediation plans.
• Run vulnerability assessments and coordinate fixes with infrastructure and application teams.
• Develop and put in place security policies and procedures.
• Build and refine detection rules, automation and playbooks to shorten response times.
• Give technical guidance and support to other IT professionals.

Requirements

• Information protection:
• Hands-on experience running Microsoft Purview DLP and Insider Risk Management in production.
• Working knowledge of sensitivity labels, information classification, encryption and retention.
• Understanding of data protection and privacy regulations and frameworks such as GDPR, ISO 27001 and NIS2, and how they become technical controls.
• Ability to balance security needs with user productivity, and to handle insider risk topics sensitively with HR, Legal and Compliance.
• Security operations:
• Knowledge of security technologies such as firewalls, intrusion detection systems and endpoint protection.
• Familiarity with networking and operating systems.
• Understanding of core security principles and best practices.
• Experience with SIEM and XDR tools, including KQL for investigation and detection.
• Ability to respond to security incidents quickly and stay calm under pressure.
• Keep up with current CVEs and emerging threats, track and assess them, and make sure the organisation is covered.
• General:
• Analytical and problem-solving skills.
• Clear communication, including explaining data protection and security topics to non-technical stakeholders.
• Discretion and sound judgement with confidential and sensitive information.
• A bachelor's degree in computer science, information technology, information security or a related field is typically required. Certifications such as Microsoft SC-401, SC-200, AZ-500, CompTIA Security+ or CISSP may also be beneficial.
• Tools you may use include Microsoft Purview (DLP, Insider Risk Management, sensitivity labels, Data Lifecycle Management, Communication Compliance, Audit and eDiscovery), Microsoft Defender XDR (Defender for Endpoint, Office 365, Identity and Cloud Apps), Microsoft Sentinel, Microsoft Intune and Entra ID, firewalls such as Cisco ASA, Barracuda NGFW/WAF and Azure Firewall, intrusion detection and prevention systems such as Snort or Suricata, and vulnerability scanners such as Nessus or Qualys.

Conditions

Hybrid working.

The company values equal opportunity and hires based on skills, qualifications and business needs.

Benefits

• A culture built on trust and accountability, with the freedom to act and make an impact.
• Flexible Leave Paid Time Off policy, remote working options, and Global Wellbeing Days.
• Tools and guidance to support your growth.
• Working and learning alongside experienced colleagues, role models and mentors.
• Sustainability initiatives, including an Environmental, Social and Governance strategy and the Act4Good programme.
• An inclusive workplace with Employee Resource Groups open to all.