Information Protection & Security Operations Engineer

Unit4

About The Position

The Information Protection & Security Operations Engineer is a hybrid role split approximately equally between information protection and security operations. The information protection work focuses on managing and improving Microsoft Purview controls—including Data Loss Prevention (DLP), Insider Risk Management, classification, and related policies—to protect sensitive company and customer data while supporting productivity. The security operations work involves deploying, configuring, monitoring, and maintaining security solutions, responding to incidents, and ensuring vulnerabilities are identified and addressed. The role works closely with IT colleagues to integrate security and data protection throughout the organization's infrastructure and help safeguard its IT estate and data.

Requirements

Hands-on experience implementing and operating Microsoft Purview DLP and Insider Risk Management in a production environment.
Practical knowledge of sensitivity labels, information classification, encryption, and retention concepts.
Understanding of data protection and privacy regulations and frameworks, such as GDPR, ISO 27001, and NIS2, and how they translate into technical controls.
Ability to balance security requirements with user productivity and work sensitively with HR, Legal, and Compliance on insider risk topics.
Knowledge of security technologies such as firewalls, intrusion detection systems, and endpoint protection.
Familiarity with networking and operating systems.
Understanding of security principles and best practices.
Experience with SIEM and XDR tooling, including KQL queries for investigation and detection.
Ability to work under pressure and respond quickly to security incidents.
Ability to stay informed about current CVEs and emerging threats, track and assess them, and ensure security coverage.
Analytical and problem-solving skills.
Effective communication and collaboration skills, including explaining data protection and security topics to non-technical stakeholders.
Discretion and sound judgement when handling confidential and sensitive information.
A bachelor's degree in computer science, information technology, information security, or a related field is typically required.

Nice To Haves

Relevant certifications such as Microsoft SC-401, SC-200, AZ-500, CompTIA Security+, or CISSP may be beneficial.

Responsibilities

Design, deploy, maintain, and tune Microsoft Purview DLP policies across Exchange, SharePoint, OneDrive, Teams, endpoints, and cloud apps.
Configure and operate Insider Risk Management, including policy templates, indicators, Adaptive Protection, and case triage, in collaboration with HR, Legal, and Compliance.
Implement and maintain information classification, including sensitivity labels, label policies, auto-labeling, and encryption.
Manage related protection policies, including retention and records management, communication compliance, and Defender for Cloud Apps session and access policies.
Monitor DLP and Insider Risk alerts, investigate policy matches, reduce false positives, and report on policy effectiveness and data protection posture.
Define and document information protection standards, processes, and runbooks, and support audits and compliance requirements.
Promote user awareness and adoption through policy tips, guidance, and training for business teams.
Deploy and configure security solutions such as intrusion detection systems and endpoint protection.
Monitor security systems, identify and respond to incidents, and triage alerts in Microsoft Defender XDR and Microsoft Sentinel.
Investigate security incidents and develop remediation plans.
Conduct vulnerability assessments and coordinate remediation with infrastructure and application teams.
Develop and implement security policies and procedures.
Build and improve detection rules, automation, and playbooks to reduce response times.
Provide technical guidance and support to other IT professionals.