Security Engineer - Data Security (DLP & Information Protection)

Role type & Location

- Full time Remote (Work from home) based either Dublin or UK only

- Occasional Travel to Dublin office if Ireland based (Glasnevin) or UK (Oxford) if UK based

Visa

- We regret we cannot offer Irish or UK visa sponsorship for this role

You will be the engineer who protects sensitive data at Deciphex

We work in clinical and research digital pathology, so the data includes patient health information, personal data and confidential business and customer data.

You will report to the Principal Engineer - Cybersecurity & DevOps and join a lean, hands-on team where each engineer owns a defined area, with no large support structure.

In your first 12 months, three priorities come first:

- Data loss prevention and information protection on Google Workspace and Microsoft 365: classification, labelling and sharing controls, so sensitive data is shared only as intended.

- Least-privilege access to sensitive data: regular access reviews, and controlled, logged sharing with external providers and customers.

- Security review of the tools, integrations and data flows that touch sensitive data, including flows to on-premises laboratory systems, integrations and workflows, and the data side of our AWS-hosted products.

Our technology environment:

- We are a Google Workspace company that also uses Microsoft services, and our products run on AWS.

- You will work with the native data-protection and audit features of each platform: Google Workspace DLP, labels and context-aware access, Microsoft Purview and SharePoint, and AWS storage, encryption and logging services, alongside the security hubs of each platform.

- We also use dedicated enterprise tools for endpoint protection and email security, and Vanta for compliance automation.

- Our Digital Trust & Transformation Office (DTO) brings together the teams that keep Deciphex trustworthy and moving forward: information security, cybersecurity, application security, DevOps, IT, data protection and privacy, AI and AI governance, and operational resilience.

- We work to one aim: our customers, clinicians and patients can trust our systems and the data in them, and our engineers can ship safely and quickly.

• This is a hands-on engineering role in our Digital Trust & Transformation Office (DTO).
• The Information Security team and Data Protection Officer own governance, risk and compliance, and rely on YOU as the data security specialist.
• The Cybersecurity Engineer owns identity, endpoints and general security operations, and YOU work together on data incidents.

More specifically;

• You will build and run the technical controls that keep it confidential wherever it lives: Google Workspace and Microsoft 365, our AWS-hosted products, other cloud and SaaS tools, or on-premises.
• Design, deploy and tune data loss prevention and information-protection controls. Set retention, versioning and recovery settings so critical data survives ransomware and accidental deletion.
• Enforce least privilege, run access reviews, fix oversharing, and control and log what leaves the company.
• Keep sensitive data located through discovery and flow mapping. Set encryption and key-management requirements for cloud data stores and verify them. The DevOps team runs the keys and infrastructure encryption.
• Carry out the technical security review of new tools, integrations and AI services before they touch sensitive data. The Information Security team, Data Protection Officer and AI governance decide on risk and approval.
• Support the application security team on app data security, and collaborate with the product and data teams to lead good practice such as access models and logging. Those teams own product controls and anonymisation.
• Monitor data access and movement in audit logs and security hubs
• Lead the technical side of data incidents: scope, contain, preserve evidence and brief the Information Security team and DPO.
• Support data subject and customer data requests. General security operations stay with the Cybersecurity Engineer.
• Support the Information Security team with the technical side of ISO 27001, NHS DSPT, GDPR and customer assurance, providing data security expertise and automated evidence. They run the frameworks and audits.
• Automate administration, investigation and reporting with Python, APIs and generative AI tooling.

What This Is Not

• Not a paperwork or policy-only role. The controls must exist and be evidenced.
• Not the application security lead. You support the application security team on app data security.
• Not a general security-operations, identity-platform, endpoint or vulnerability-management role. Those sit with the Cybersecurity Engineer. Your incident work is about data.
• Not a privacy-engineering or anonymisation role. Those sit with the data and product teams.
• Not a legal or compliance role. The Information Security team and Data Protection Officer own governance.
• We know where our sensitive data is, who can reach it and how it moves.
• Sensitive data is shared only as intended, access is reviewed regularly, and external sharing is controlled and logged.
• New tools and integrations are security-reviewed before they touch sensitive data, without slowing delivery.
• Data incidents are scoped quickly and accurately, and audit evidence is automated and current.

• 5/6+ years of hands-on security engineering, including ownership of security controls in production.
• Hands-on DLP or information-protection experience in Google Workspace: sharing and external-access controls, labels and rules, and context-aware access.
• Working knowledge of Microsoft 365 data security: Purview, SharePoint sharing and permissions, and how Entra ID access applies to data.
• Strong access-control fundamentals across SaaS and cloud (Google Workspace, Entra ID, AWS), including how data is stored and encrypted.
• Python scripting and API automation, and practical experience using generative AI tooling to work faster and more reliably.
• Able to investigate data access and movement using audit logs, a SIEM, a security hub or native platform tools.
• Able to work with product, engineering, research, clinical, privacy and information-security colleagues, and explain both the risk and the practical control.
• Experience with health or other regulated data helps. We will teach you our regulatory and clinical context, so you need to arrive knowing how to protect data with working controls.

• 💰 Salary with performance-based annual increases to recognise your contribution.
• 🩺 Healthcare benefits to support your wellbeing.
• 🌴 Annual leave plus additional Christmas leave to rest and recharge.
• 🔬 Meaningful work that helps improve patient outcomes.
• 🚀 A growing company where you can make your mark.
• 💡 Varied, challenging projects to keep you learning.
• 📈 Regular feedback and career opportunities to help you progress.
• 🤝 A supportive, multicultural team to share ideas and learn from.

Through the work that we do, the team at Deciphex helps pharma to accelerate the process of essential drug development and helps cancer patients get a timely and accurate diagnosis.

Founded in Dublin (Ireland) in 2017, Deciphex has scaled rapidly to a team of over 230 people and counting who are providing software solutions to address the pathology gap in research pathology and clinical areas. We have offices in Dublin, Exeter, Oxford, Chicago and Toronto, and are expanding our team throughout the world.

We are software developers, clinical specialists, artificial intelligence engineers, operations professionals and so much more, all working as one team to support our customers and patients.

Read more about Deciphex here and more about our team on our Careers Page here.

Deciphex is an equal opportunities employer and we are committed to the principle of equality. All qualified applicants will be considered for employment without regard to age, race, religious beliefs, political views, gender identity, affectional or sexual orientation, national origin, family or marital status (including pregnancy), disability, membership of the travelling community or any other classification protected by applicable law.

A copy of our Privacy Policy can be viewed here.