Summary

We’re looking for an experienced Information Security Operations Specialist in Frankfurt to keep our technology environment secure day to day. You’ll work hands-on with Microsoft 365, Purview, Defender, Azure, identity and access management, and network security. The role connects security policy with daily operations. Working closely with IT, you’ll monitor threats, fix vulnerabilities, manage security settings and changes, and make sure we meet our internal policies and regulations such as DORA.

Duties & responsibilities

• Run and improve our Microsoft 365 security tools, including Defender XDR, Defender for Cloud, Defender for Endpoint, Defender for Identity, Sentinel and Entra ID.
• Own security monitoring (SIEM and SOC) and work with external security providers to make sure threats and vulnerabilities are dealt with.
• Set up and manage data loss prevention (DLP) policies in Purview to stop sensitive data from leaving the company.
• Manage user identities and access in Entra ID, including single sign-on (SSO), Conditional Access and Privileged Identity Management (PIM), and watch for risky or suspicious sign-ins.
• Run the vulnerability management process: find, assess and prioritize vulnerabilities, and make sure they get fixed.
• Handle security tickets and requests in the ITSM queue and respond to security incidents.
• Keep Azure and our wider infrastructure secure through security baselines, configuration reviews and hardening.
• Oversee security for enterprise applications and business services.
• Make sure we comply with DORA, and help the IT, Risk and Compliance teams put the Group Information Security Strategy into practice.
• Carry out first-line security controls and reviews, fix findings and escalate risks.
• Support internal and external audits, regulatory inspections, penetration tests and control assessments.
• Review technology changes from a security point of view and give approvals and recommendations.
• Lead the response to major ICT incidents, including communication, escalation, stakeholder updates and post-incident reviews, and report them to regulators as DORA requires.

Professional & personal qualifications

• 5+ years of hands-on experience in information security operations
• 3+ years of experience with Microsoft 365 and cloud environments (ideally Azure)
• Degree in computer science, IT, cyber security or a related field, or equivalent experience
• Experience securing Microsoft 365 (Intune, SharePoint, Teams, Exchange) through the Microsoft security portals
• Experience with Entra ID, including Identity Protection, Privileged Access Management and Conditional Access
• Hands-on experience with DLP in Purview
• Good understanding of network security, such as firewalls, VPNs and intrusion detection/prevention
• Microsoft security certifications (SC-900, SC-200, SC-300 or SC-400) are a plus
• Familiarity with DORA, ISO 27001 or NIST
• Able to meet deadlines, stay calm under pressure and keep others on track
• Fluent English, written and spoken; German is a plus