Cyber Security GRC
Job Purpose MSC Group's Cruise Division is recruiting a Information Protection & Data Security Specialist within the Cyber Security GRC department to support the implementation, operation and continuous improvement of controls that protect sensitive and business-critical information across the organization. Job Purpose MSC Group's Cruise Division is recruiting a Information Protection & Data Security Specialist within the Cyber Security GRC department to support the implementation, operation and continuous improvement of controls that protect sensitive and business-critical information across the organization. Key Accountabilities Information Protection Governance and Data Classification
* Support the maintenance of the Information Protection governance model, control framework, service backlog and supporting documentation, applying agreed responsibilities across Cyber Security, IT, Data Owners and business functions.
* Maintain data-classification artefacts, including classification criteria, sensitivity labels, handling rules, ownership requirements and minimum protection measures, under the guidance of senior team members.
* Configure, test and document Microsoft Purview sensitivity labels and label policies, including manual, recommended and automatic labelling, encryption and rights-protection controls, in line with approved requirements.
* Execute data-discovery and data-mapping activities to identify where sensitive and regulated information is stored, processed, shared and transmitted; document coverage gaps and support remediation across Microsoft 365, cloud, endpoint and on-premises environments.
* Maintain Information Protection policies, standards, procedures, exception records and user guidance; support periodic reviews and elevate inconsistencies or control gaps. Data Loss Prevention and Data Exfiltration
* Configure, test, monitor and tune approved risk-based DLP policies across Microsoft 365 workloads, endpoints, email and relevant cloud applications, documenting results and business impact.
* Apply the approved DLP alert-management process, including severity criteria, assignment, escalation, exception handling and remediation tracking; investigate routine alerts and elevate complex or high-risk events.
* Support the operation of Insider Risk Management and Communication Compliance use cases, applying approved access restrictions, segregation of duties, privacy safeguards and escalation paths.
* Collect, validate and report DLP and data-protection metrics, including control coverage, policy effectiveness, false-positive rates, repeat violations, exception ageing and remediation status.
* Test data-exfiltration detection scenarios and response playbooks with Cyber Defense and SOC teams, document outcomes and incorporate approved improvements into procedures and configurations. Data Lifecycle, Encryption and Data Security
* Apply retention, archiving and secure-disposal control requirements agreed with Legal, Records Management, the Data Protection Officer and accountable Data Owners, and document implementation evidence.
* Configure, test and document encryption, rights-protection and secure-data-transfer controls for data at rest and in transit across Microsoft 365,
cloud services, applications and third-party platforms, following approved standards.
* Support Data Protection Impact Assessments, data-processing agreements, solution reviews and transformation projects by collecting and documenting information on data flows, access, storage, sharing, retention and technical protection measures.
* Execute evidence collection, control testing, gap documentation and remediation tracking for technical and organizational measures supporting GDPR, PCI DSS and other applicable data-protection requirements.
* Apply and test approved data-security requirements for cloud, SaaS, endpoint, application, third-party and AI use cases, including controls intended to prevent sensitive-data exposure to generative AI services; elevate design exceptions to senior specialists. Data Risk, Assurance and Performance
* Support the identification, assessment and monitoring of data-related Cyber Security risks by maintaining risk records, control mappings, exceptions, treatment actions and supporting evidence within the corporate GRC framework.
* Execute assigned control-effectiveness tests, support internal and external audits, maintain reliable evidence and monitor agreed remediation actions, elevate overdue or ineffective actions.
* Support compliance activities involving information protection and data security by mapping controls and evidence to applicable frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
* Perform assigned data-protection checks for suppliers and services that store, process or access sensitive information, document findings and support Third-Party Risk Management activities, including due diligence, contractual controls and remediation tracking.
* Ma
* Support the maintenance of the Information Protection governance model, control framework, service backlog and supporting documentation, applying agreed responsibilities across Cyber Security, IT, Data Owners and business functions.
* Maintain data-classification artefacts, including classification criteria, sensitivity labels, handling rules, ownership requirements and minimum protection measures, under the guidance of senior team members.
* Configure, test and document Microsoft Purview sensitivity labels and label policies, including manual, recommended and automatic labelling, encryption and rights-protection controls, in line with approved requirements.
* Execute data-discovery and data-mapping activities to identify where sensitive and regulated information is stored, processed, shared and transmitted; document coverage gaps and support remediation across Microsoft 365, cloud, endpoint and on-premises environments.
* Maintain Information Protection policies, standards, procedures, exception records and user guidance; support periodic reviews and elevate inconsistencies or control gaps. Data Loss Prevention and Data Exfiltration
* Configure, test, monitor and tune approved risk-based DLP policies across Microsoft 365 workloads, endpoints, email and relevant cloud applications, documenting results and business impact.
* Apply the approved DLP alert-management process, including severity criteria, assignment, escalation, exception handling and remediation tracking; investigate routine alerts and elevate complex or high-risk events.
* Support the operation of Insider Risk Management and Communication Compliance use cases, applying approved access restrictions, segregation of duties, privacy safeguards and escalation paths.
* Collect, validate and report DLP and data-protection metrics, including control coverage, policy effectiveness, false-positive rates, repeat violations, exception ageing and remediation status.
* Test data-exfiltration detection scenarios and response playbooks with Cyber Defense and SOC teams, document outcomes and incorporate approved improvements into procedures and configurations. Data Lifecycle, Encryption and Data Security
* Apply retention, archiving and secure-disposal control requirements agreed with Legal, Records Management, the Data Protection Officer and accountable Data Owners, and document implementation evidence.
* Configure, test and document encryption, rights-protection and secure-data-transfer controls for data at rest and in transit across Microsoft 365,
cloud services, applications and third-party platforms, following approved standards.
* Support Data Protection Impact Assessments, data-processing agreements, solution reviews and transformation projects by collecting and documenting information on data flows, access, storage, sharing, retention and technical protection measures.
* Execute evidence collection, control testing, gap documentation and remediation tracking for technical and organizational measures supporting GDPR, PCI DSS and other applicable data-protection requirements.
* Apply and test approved data-security requirements for cloud, SaaS, endpoint, application, third-party and AI use cases, including controls intended to prevent sensitive-data exposure to generative AI services; elevate design exceptions to senior specialists. Data Risk, Assurance and Performance
* Support the identification, assessment and monitoring of data-related Cyber Security risks by maintaining risk records, control mappings, exceptions, treatment actions and supporting evidence within the corporate GRC framework.
* Execute assigned control-effectiveness tests, support internal and external audits, maintain reliable evidence and monitor agreed remediation actions, elevate overdue or ineffective actions.
* Support compliance activities involving information protection and data security by mapping controls and evidence to applicable frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
* Perform assigned data-protection checks for suppliers and services that store, process or access sensitive information, document findings and support Third-Party Risk Management activities, including due diligence, contractual controls and remediation tracking.
* Ma