Cyber Security GRC - Information Protection Specialist

MSC Cruises; Napoli; Hybrid; EUR 33,000 - 37,000; Full time

Benefits offered by this job

Meal vouchers

Health Insurance

Productivity award

Job summary

MSC Cruises is seeking an Information Protection & Data Security Specialist within the Cyber Security GRC team in Napoli, Italy. You will implement and operate controls protecting sensitive information across Microsoft 365, cloud and on‑prem environments, aligning with GDPR, PCI DSS and other standards.

The role requires collaboration with IT, Legal, and business units, and involves ongoing improvements to data-security programs.

Qualifications

• 2–5 years of experience in Information Protection or Data Security, including DLP
• Experience with governance, risk and compliance in complex organizations
• Certifications such as Microsoft SC-401 (or SC-400) or IAPP/CIPT are a plus
• Strong understanding of data classification, retention, encryption, and DPI requirements
• Fluent in English and Italian with ability to produce technical documentation

Responsibilities

• Maintain Information Protection governance and data-classification artefacts
• Configure and tune Microsoft Purview policies and labels
• Develop, test and report DLP policies across Microsoft 365 and cloud workloads
• Support data lifecycle controls, encryption and secure data transfer
• Contribute to risk assessment, audits and KPI/KRI reporting

Skills

Information Protection

Data Security

DLP

GRC

Education

Degree in Cybersecurity or related field

Tools

Microsoft Purview

Microsoft 365

Azure

Job description

Job Purpose

MSC Group's Cruise Division is recruiting a Information Protection & Data Security Specialist within the Cyber Security GRC department to support the implementation, operation and continuous improvement of controls that protect sensitive and business-critical information across the organization.

Job Purpose

MSC Group's Cruise Division is recruiting a Information Protection & Data Security Specialist within the Cyber Security GRC department to support the implementation, operation and continuous improvement of controls that protect sensitive and business-critical information across the organization.

Key Accountabilities

Information Protection Governance and Data Classification

• Support the maintenance of the Information Protection governance model, control framework, service backlog and supporting documentation, applying agreed responsibilities across Cyber Security, IT, Data Owners and business functions.
• Maintain data-classification artefacts, including classification criteria, sensitivity labels, handling rules, ownership requirements and minimum protection measures, under the guidance of senior team members.
• Configure, test and document Microsoft Purview sensitivity labels and label policies, including manual, recommended and automatic labelling, encryption and rights-protection controls, in line with approved requirements.
• Execute data-discovery and data-mapping activities to identify where sensitive and regulated information is stored, processed, shared and transmitted; document coverage gaps and support remediation across Microsoft 365, cloud, endpoint and on-premises environments.
• Maintain Information Protection policies, standards, procedures, exception records and user guidance; support periodic reviews and elevate inconsistencies or control gaps.

Data Loss Prevention and Data Exfiltration

• Configure, test, monitor and tune approved risk-based DLP policies across Microsoft 365 workloads, endpoints, email and relevant cloud applications, documenting results and business impact.
• Apply the approved DLP alert-management process, including severity criteria, assignment, escalation, exception handling and remediation tracking; investigate routine alerts and elevate complex or high-risk events.
• Support the operation of Insider Risk Management and Communication Compliance use cases, applying approved access restrictions, segregation of duties, privacy safeguards and escalation paths.
• Collect, validate and report DLP and data-protection metrics, including control coverage, policy effectiveness, false-positive rates, repeat violations, exception ageing and remediation status.
• Test data-exfiltration detection scenarios and response playbooks with Cyber Defense and SOC teams, document outcomes and incorporate approved improvements into procedures and configurations.

Data Lifecycle, Encryption and Data Security

• Apply retention, archiving and secure-disposal control requirements agreed with Legal, Records Management, the Data Protection Officer and accountable Data Owners, and document implementation evidence.
• Configure, test and document encryption, rights-protection and secure-data-transfer controls for data at rest and in transit across Microsoft 365, cloud services, applications and third-party platforms, following approved standards.
• Support Data Protection Impact Assessments, data-processing agreements, solution reviews and transformation projects by collecting and documenting information on data flows, access, storage, sharing, retention and technical protection measures.
• Execute evidence collection, control testing, gap documentation and remediation tracking for technical and organizational measures supporting GDPR, PCI DSS and other applicable data-protection requirements.
• Apply and test approved data-security requirements for cloud, SaaS, endpoint, application, third-party and AI use cases, including controls intended to prevent sensitive-data exposure to generative AI services; elevate design exceptions to senior specialists.

Data Risk, Assurance and Performance

• Support the identification, assessment and monitoring of data-related Cyber Security risks by maintaining risk records, control mappings, exceptions, treatment actions and supporting evidence within the corporate GRC framework.
• Execute assigned control-effectiveness tests, support internal and external audits, maintain reliable evidence and monitor agreed remediation actions, elevate overdue or ineffective actions.
• Support compliance activities involving information protection and data security by mapping controls and evidence to applicable frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
• Perform assigned data-protection checks for suppliers and services that store, process or access sensitive information, document findings and support Third-Party Risk Management activities, including due diligence, contractual controls and remediation tracking.
• Maintain project plans, risks, dependencies, KPIs and KRIs for assigned activities and prepare accurate reporting on control coverage, residual risk, overdue actions and recurring issues for review by the Cyber Security GRC Lead.

Qualifications

• Professional fluency in English and Italian, with the ability to prepare clear technical, governance and management documentation.
• Degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related discipline, or equivalent relevant professional experience.
• 2-5 years of relevant experience in Information Protection, Data Security or DLP, including practical experience delivering controls in a complex organization; exposure to Cyber Security GRC, risk or audit activities is strongly preferred.
• Good understanding of data classification, information ownership, handling rules, data lifecycle, retention, secure disposal, encryption, data-exfiltration threats and privacy-by-design principles.
• Practical experience with Microsoft Purview, particularly Information Protection, sensitivity labels, Data Loss Prevention or Endpoint DLP, including policy configuration, testing, deployment support, tuning and reporting.
• Working knowledge of Microsoft 365 and Azure data-protection capabilities, endpoint and cloud security controls, encryption and key-management concepts, and the interaction between identity, access and data protection.
• Good working knowledge of Cyber Security governance, risk and compliance principles and of data-protection controls within frameworks and requirements such as ISO/IEC 27001, ISO/IEC 27701, NIST, PCI DSS, NIS2 and GDPR.
• Ability to apply legal, regulatory, business and risk requirements through documented technical configurations, operating procedures, tests and assurance evidence, with guidance where required.
• Experience supporting DLP policy operation, including alert review, exceptions, false-positive analysis, testing and documentation of business impact.
• Good stakeholder-management and communication skills, with the ability to work effectively with Cyber Security, IT, Digital, Data, AI, application teams, business functions, the Data Protection Officer, Legal, Human Resources, Procurement, Audit and Compliance.
• Analytical and structured mindset, with the ability to investigate data-protection events, document root causes and control gaps, execute agreed remediation actions and elevate complex matters clearly.
• Relevant certifications such as Microsoft SC-401 (or legacy SC-400), ISO/IEC 27701 Foundation, IAPP CIPP/E or CIPT, or equivalent entry-to-intermediate qualifications will be considered an advantage.

VISA Requirements

Right to work in Italy.

What we offer

In compliance with the applicable pay transparency legislation, the following information is provided regarding the initial compensation foreseen for the position.

Contract

• Type of contract: Permanent
• Hybrid working model: 2 days per week remotely
• Applicable Collective Labour Agreement (CCNL): "Addetti agli uffici ed ai terminals delle società di navigazione che esercitano l'armamento privato" - sez. personale di terra
• Gross annual salary (RAL): between €33.000 - €37.000 gross per year, paid over 14 monthly installments
• Meal vouchers: worth €8 per on-site working day

Welfare&Wellbeing

We offer a range of Welfare&Wellbeing Initiatives as well as benefits including Productivity award, Health Insurance, Learning opportunities, flexible working hours, Employee Assistance Programme, Discounts & Partnerships within the MSC group.

Our commitment

We are committed to building a future that values diverse perspectives, embraces the world beyond borders, and fosters an inclusive environment where every individual feels valued, respected and empowered to be their authentic selves. Our commitment extends to taking meaningful, measurable actions that have a long-term positive impact on our guests, our employees and our planet.