Cyber Security GRC - Information Protection Specialist
Job Purpose
MSC Group's Cruise Division is recruiting a Information Protection & Data Security Specialist within the Cyber Security GRC department to support the implementation, operation and continuous improvement of controls that protect sensitive and business-critical information across the organization. The role supports activities covering data classification and labelling, Data Loss Prevention (DLP), data discovery, information lifecycle, encryption and key-management requirements, insider-risk controls and data-exfiltration prevention for confidential information, personal data, payment card data and other regulated or critical information.
The specialist will configure, test, monitor and maintain controls within the Microsoft Purview ecosystem, including Information Protection, DLP, Endpoint DLP, Data Lifecycle and Records Management, Insider Risk Management and Communication Compliance, following approved policies, standards and implementation plans.
The role combines developing governance knowledge with hands-on technical execution. It applies defined control requirements, supports policy configuration and validation, documents results and escalates complex or high-risk cases to the relevant senior specialists, IT, SOC or managed-service teams.
Working with Cyber Security, IT, Digital, Data and AI teams, the Data Protection Officer, Legal, business stakeholders and control functions, the specialist will maintain accurate records of data-protection risks, controls, exceptions, findings and remediation actions and support timely reporting and follow-up.
Key Accountabilities
Information Protection Governance and Data Classification
- Support the maintenance of the Information Protection governance model, control framework, service backlog and supporting documentation, applying agreed responsibilities across Cyber Security, IT, Data Owners and business functions.
- Maintain data-classification artefacts, including classification criteria, sensitivity labels, handling rules, ownership requirements and minimum protection measures, under the guidance of senior team members.
- Configure, test and document Microsoft Purview sensitivity labels and label policies, including manual, recommended and automatic labelling, encryption and rights-protection controls, in line with approved requirements.
- Execute data-discovery and data-mapping activities to identify where sensitive and regulated information is stored, processed, shared and transmitted; document coverage gaps and support remediation across Microsoft 365, cloud, endpoint and on-premises environments.
- Maintain Information Protection policies, standards, procedures, exception records and user guidance; support periodic reviews and escalate inconsistencies or control gaps.
Data Loss Prevention and Data Exfiltration
- Configure, test, monitor and tune approved risk-based DLP policies across Microsoft 365 workloads, endpoints, email and relevant cloud applications, documenting results and business impact.
- Apply the approved DLP alert-management process, including severity criteria, assignment, escalation, exception handling and remediation tracking; investigate routine alerts and escalate complex or high-risk events.
- Support the operation of Insider Risk Management and Communication Compliance use cases, applying approved access restrictions, segregation of duties, privacy safeguards and escalation paths.
- Collect, validate and report DLP and data-protection metrics, including control coverage, policy effectiveness, false-positive rates, repeat violations, exception ageing and remediation status.
- Test data-exfiltration detection scenarios and response playbooks with Cyber Defense and SOC teams, document outcomes and incorporate approved improvements into procedures and configurations.
.
Data Lifecycle, Encryption and Data Security
- Apply retention, archiving and secure-disposal control requirements agreed with Legal, Records Management, the Data Protection Officer and accountable Data Owners, and document implementation evidence.
- Configure, test and document encryption, rights-protection and secure-data-transfer controls for data at rest and in transit across Microsoft 365, cloud services, applications and third-party platforms, following approved standards.
- Support Data Protection Impact Assessments, data-processing agreements, solution reviews and transformation projects by collecting and documenting information on data flows, access, storage, sharing, retention and technical protection measures.
- Execute evidence collection, control testing, gap documentation and remediation tracking for technical and organizational measures supporting GDPR, PCI DSS and other applicable data-protection requirements.
- Apply and test approved data-security requirements for cloud, SaaS, endpoint, application, third-party and AI use cases, including controls intended to prevent sensitive-data exposure to generative AI services; escalate design exceptions to senior specialists.
Data Risk, Assurance and Performance
- Support the identification, assessment and monitoring of data-related Cyber Security risks by maintaining risk records, control mappings, exceptions, treatment actions and supporting evidence within the corporate GRC framework.
- Execute assigned control-effectiveness tests, support internal and external audits, maintain reliable evidence and monitor agreed remediation actions, escalating overdue or ineffective actions.
- Support compliance activities involving information protection and data security by mapping controls and evidence to applicable frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
- Perform assigned data-protection checks for suppliers and services that store, process or access sensitive information, document findings and support Third-Party Risk Management activities, including due diligence, contractual controls and remediation tracking.
- Maintain project plans, risks, dependencies, KPIs and KRIs for assigned activities and prepare accurate reporting on control coverage, residual risk, overdue actions and recurring issues for review by the Cyber Security GRC Lead.
Qualifications
• Professional fluency in English and Italian, with the ability to prepare clear technical, governance and management documentation.
- Degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related discipline, or equivalent relevant professional experience.
- 2-5 years of relevant experience in Information Protection, Data Security or DLP, including practical experience delivering controls in a complex organization; exposure to Cyber Security GRC, risk or audit activities is strongly preferred.
- Good understanding of data classification,
information ownership, handling rules, data lifecycle, retention, secure disposal, encryption, data-exfiltration threats and privacy-by-design principles.
- Practical experience with Microsoft Purview, particularly Information Protection, sensitivity labels, Data Loss Prevention or Endpoint DLP, including policy configuration, testing, deployment support, tuning and reporting.
- Working knowledge of Microsoft 365 and Azure data-protection capabilities, endpoint and cloud security controls, encryption and key-management concepts, and the interaction between identity, access and data protection.
- Good working knowledge of Cyber Security governance, risk and compliance principles and of data-protection controls within frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
- Ability to apply legal, regulatory, business and risk requirements through documented technical configurations, operating procedures, tests and assurance evidence, with guidance where required.
- Experience supporting DLP policy operation, including alert review, exceptions, false-positive analysis, testing and documentation of business impact.
- Good stakeholder-management and communication skills, with the ability to work effectively with Cyber Security, IT, Digital, Data, AI, application teams, business functions, the Data Protection Officer, Legal, Human Resources, Procurement, Audit and Compliance.
- Analytical and structured mindset, with the ability to investigate data-protection events, document root causes and control gaps, execute agreed remediation actions and escalate complex matters clearly.
- Relevant certifications such as Microsoft SC-401 (or legacy SC-400), ISO/IEC 27701 Foundation, IAPP CIPP/E or CIPT, or equivalent entry-to-intermediate qualifications will be considered an advantage.
VISA Requirements
Right to work in Italy.
What we offer
In compliance with the applicable pay transparency legislation, the following information is provided regarding the initial compensation foreseen for the position.
Contract
- Type of contract: Permanent
- Hybrid working model: 2 days per week remotely
- Applicable Collective Labour Agreement (CCNL): “Addetti agli uffici ed ai terminals delle società di navigazione che esercitano l’armamento privato” – sez. personale di terra
- Gross annual salary (RAL): between €33.000 – €37.000 gross per year, paid over 14 monthly installments
- Meal vouchers: worth €8 per on-site working day The offer in terms of salary will be determined based on the candidate’s professional experience, technical competencies, and the level of autonomy and responsibility assigned to the role.
Welfare&Wellbeing;
We offer a range of Welfare&Wellbeing; Initiatives as well as benefits including Productivity award, Health Insurance, Learning opportunities, flexible working hours, Employee Assistance Programme, Discounts & Partnerships within the MSC group.
Our commitment
We are committed to building a future that values diverse perspectives, embraces the world beyond borders, and fosters an inclusive environment where every individual feels valued, respected and empowered to be their authentic selves. Our commitment extends to taking meaningful, measurable actions that have a long-term positive impact on our guests, our employees and our planet. Ready to turn your passion into something extraordinary? Join us at MSC Cruises, where new opportunities await. Apply today to be part of a global team that is pushing boundaries and achieving something remarkable. Your journey starts here!
MSC Group's Cruise Division is recruiting a Information Protection & Data Security Specialist within the Cyber Security GRC department to support the implementation, operation and continuous improvement of controls that protect sensitive and business-critical information across the organization. The role supports activities covering data classification and labelling, Data Loss Prevention (DLP), data discovery, information lifecycle, encryption and key-management requirements, insider-risk controls and data-exfiltration prevention for confidential information, personal data, payment card data and other regulated or critical information.
The specialist will configure, test, monitor and maintain controls within the Microsoft Purview ecosystem, including Information Protection, DLP, Endpoint DLP, Data Lifecycle and Records Management, Insider Risk Management and Communication Compliance, following approved policies, standards and implementation plans.
The role combines developing governance knowledge with hands-on technical execution. It applies defined control requirements, supports policy configuration and validation, documents results and escalates complex or high-risk cases to the relevant senior specialists, IT, SOC or managed-service teams.
Working with Cyber Security, IT, Digital, Data and AI teams, the Data Protection Officer, Legal, business stakeholders and control functions, the specialist will maintain accurate records of data-protection risks, controls, exceptions, findings and remediation actions and support timely reporting and follow-up.
Key Accountabilities
Information Protection Governance and Data Classification
- Support the maintenance of the Information Protection governance model, control framework, service backlog and supporting documentation, applying agreed responsibilities across Cyber Security, IT, Data Owners and business functions.
- Maintain data-classification artefacts, including classification criteria, sensitivity labels, handling rules, ownership requirements and minimum protection measures, under the guidance of senior team members.
- Configure, test and document Microsoft Purview sensitivity labels and label policies, including manual, recommended and automatic labelling, encryption and rights-protection controls, in line with approved requirements.
- Execute data-discovery and data-mapping activities to identify where sensitive and regulated information is stored, processed, shared and transmitted; document coverage gaps and support remediation across Microsoft 365, cloud, endpoint and on-premises environments.
- Maintain Information Protection policies, standards, procedures, exception records and user guidance; support periodic reviews and escalate inconsistencies or control gaps.
Data Loss Prevention and Data Exfiltration
- Configure, test, monitor and tune approved risk-based DLP policies across Microsoft 365 workloads, endpoints, email and relevant cloud applications, documenting results and business impact.
- Apply the approved DLP alert-management process, including severity criteria, assignment, escalation, exception handling and remediation tracking; investigate routine alerts and escalate complex or high-risk events.
- Support the operation of Insider Risk Management and Communication Compliance use cases, applying approved access restrictions, segregation of duties, privacy safeguards and escalation paths.
- Collect, validate and report DLP and data-protection metrics, including control coverage, policy effectiveness, false-positive rates, repeat violations, exception ageing and remediation status.
- Test data-exfiltration detection scenarios and response playbooks with Cyber Defense and SOC teams, document outcomes and incorporate approved improvements into procedures and configurations.
.
Data Lifecycle, Encryption and Data Security
- Apply retention, archiving and secure-disposal control requirements agreed with Legal, Records Management, the Data Protection Officer and accountable Data Owners, and document implementation evidence.
- Configure, test and document encryption, rights-protection and secure-data-transfer controls for data at rest and in transit across Microsoft 365, cloud services, applications and third-party platforms, following approved standards.
- Support Data Protection Impact Assessments, data-processing agreements, solution reviews and transformation projects by collecting and documenting information on data flows, access, storage, sharing, retention and technical protection measures.
- Execute evidence collection, control testing, gap documentation and remediation tracking for technical and organizational measures supporting GDPR, PCI DSS and other applicable data-protection requirements.
- Apply and test approved data-security requirements for cloud, SaaS, endpoint, application, third-party and AI use cases, including controls intended to prevent sensitive-data exposure to generative AI services; escalate design exceptions to senior specialists.
Data Risk, Assurance and Performance
- Support the identification, assessment and monitoring of data-related Cyber Security risks by maintaining risk records, control mappings, exceptions, treatment actions and supporting evidence within the corporate GRC framework.
- Execute assigned control-effectiveness tests, support internal and external audits, maintain reliable evidence and monitor agreed remediation actions, escalating overdue or ineffective actions.
- Support compliance activities involving information protection and data security by mapping controls and evidence to applicable frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
- Perform assigned data-protection checks for suppliers and services that store, process or access sensitive information, document findings and support Third-Party Risk Management activities, including due diligence, contractual controls and remediation tracking.
- Maintain project plans, risks, dependencies, KPIs and KRIs for assigned activities and prepare accurate reporting on control coverage, residual risk, overdue actions and recurring issues for review by the Cyber Security GRC Lead.
Qualifications
• Professional fluency in English and Italian, with the ability to prepare clear technical, governance and management documentation.
- Degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related discipline, or equivalent relevant professional experience.
- 2-5 years of relevant experience in Information Protection, Data Security or DLP, including practical experience delivering controls in a complex organization; exposure to Cyber Security GRC, risk or audit activities is strongly preferred.
- Good understanding of data classification,
information ownership, handling rules, data lifecycle, retention, secure disposal, encryption, data-exfiltration threats and privacy-by-design principles.
- Practical experience with Microsoft Purview, particularly Information Protection, sensitivity labels, Data Loss Prevention or Endpoint DLP, including policy configuration, testing, deployment support, tuning and reporting.
- Working knowledge of Microsoft 365 and Azure data-protection capabilities, endpoint and cloud security controls, encryption and key-management concepts, and the interaction between identity, access and data protection.
- Good working knowledge of Cyber Security governance, risk and compliance principles and of data-protection controls within frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
- Ability to apply legal, regulatory, business and risk requirements through documented technical configurations, operating procedures, tests and assurance evidence, with guidance where required.
- Experience supporting DLP policy operation, including alert review, exceptions, false-positive analysis, testing and documentation of business impact.
- Good stakeholder-management and communication skills, with the ability to work effectively with Cyber Security, IT, Digital, Data, AI, application teams, business functions, the Data Protection Officer, Legal, Human Resources, Procurement, Audit and Compliance.
- Analytical and structured mindset, with the ability to investigate data-protection events, document root causes and control gaps, execute agreed remediation actions and escalate complex matters clearly.
- Relevant certifications such as Microsoft SC-401 (or legacy SC-400), ISO/IEC 27701 Foundation, IAPP CIPP/E or CIPT, or equivalent entry-to-intermediate qualifications will be considered an advantage.
VISA Requirements
Right to work in Italy.
What we offer
In compliance with the applicable pay transparency legislation, the following information is provided regarding the initial compensation foreseen for the position.
Contract
- Type of contract: Permanent
- Hybrid working model: 2 days per week remotely
- Applicable Collective Labour Agreement (CCNL): “Addetti agli uffici ed ai terminals delle società di navigazione che esercitano l’armamento privato” – sez. personale di terra
- Gross annual salary (RAL): between €33.000 – €37.000 gross per year, paid over 14 monthly installments
- Meal vouchers: worth €8 per on-site working day The offer in terms of salary will be determined based on the candidate’s professional experience, technical competencies, and the level of autonomy and responsibility assigned to the role.
Welfare&Wellbeing;
We offer a range of Welfare&Wellbeing; Initiatives as well as benefits including Productivity award, Health Insurance, Learning opportunities, flexible working hours, Employee Assistance Programme, Discounts & Partnerships within the MSC group.
Our commitment
We are committed to building a future that values diverse perspectives, embraces the world beyond borders, and fosters an inclusive environment where every individual feels valued, respected and empowered to be their authentic selves. Our commitment extends to taking meaningful, measurable actions that have a long-term positive impact on our guests, our employees and our planet. Ready to turn your passion into something extraordinary? Join us at MSC Cruises, where new opportunities await. Apply today to be part of a global team that is pushing boundaries and achieving something remarkable. Your journey starts here!