Data Security Engineer

About the role

Bamboohr is seeking a Data Security Engineer to join their team and take ownership of protecting sensitive information across the organization. In this role, you will be responsible for designing, implementing, and maintaining security controls that safeguard data assets and ensure the company meets its compliance obligations. You will work hand in hand with engineering, operations, and business teams to identify vulnerabilities, assess risks, and apply appropriate measures to reduce the organization's exposure to data threats. The position is based in either Glasgow or Newbury / Reading, Berkshire, and is a full-time role with a focus on building and sustaining a strong security posture.

Key facts

What you'll do

1. Design and implement data security architectures that protect sensitive information across Bamboohr systems, platforms, and internal networks.

2. Conduct regular security assessments and audits to identify vulnerabilities in data storage, processing, and transmission channels.

3. Develop and enforce data classification policies to ensure proper handling of confidential, sensitive, and regulated information.

4. Collaborate with engineering teams to integrate security controls into data pipelines, application workflows, and development processes.

5. Monitor data access patterns and investigate anomalies that may indicate unauthorized use, policy violations, or potential breaches.

6. Lead incident response activities related to data security events, including containment, root cause analysis, and remediation.

1. Create and maintain comprehensive documentation for security procedures, technical configurations, and operational runbooks.

8. Perform penetration testing and vulnerability scanning on databases, file systems, data warehouses, and other repositories.

9. Advise stakeholders on data protection best practices and regulatory requirements relevant to the business and its customers.

10. Manage encryption technologies and key management systems to ensure data remains protected both at rest and in transit.

11. Support the development of data governance frameworks that align with organizational security objectives and risk tolerance.

12. Participate in third-party risk assessments to evaluate the security posture of vendors, partners, and external service providers.

Requirements

1. Bachelor degree in computer science, information security, or a related technical discipline from an accredited institution.

2. Minimum of three years of hands-on experience in data security, information assurance, or a closely related field.

3. Strong understanding of data protection principles, including encryption standards, access control models, and data loss prevention techniques.

4. Demonstrated experience with database security, including SQL injection prevention, secure query design, and database hardening.

5. Familiarity with regulatory frameworks such as GDPR, PCI DSS, or ISO 27001 and their practical application.

6. Proven ability to write secure code and conduct thorough code reviews to identify security weaknesses early.

7. Experience with identity and access management systems, directory services, and privilege escalation controls.

8. Excellent analytical skills and the ability to communicate complex security concepts clearly to non-technical audiences.

Nice to have

1. Professional certifications such as CISSP, CISM, or CEH that demonstrate a sustained commitment to the security field.

2. Prior experience working in a financial services or regulated industry environment with strict compliance demands.

3. Knowledge of cloud security platforms and services offered by major providers such as AWS or Azure.

4. Familiarity with security orchestration and automation tools that streamline incident detection and response workflows.

Skills & tools

1. Proficiency in scripting languages such as Python, Java, or PowerShell for building security automation and custom tooling.

2. Experience with SIEM platforms including Splunk, QRadar, or Microsoft Sentinel for centralized log analysis and alerting.

3. Working knowledge of firewalls, intrusion detection systems, and network security appliances used to protect data in motion.

4. Familiarity with data loss prevention software and cloud access security brokers for monitoring and controlling data flows.

5. Understanding of DevSecOps practices and the integration of security checks into continuous integration and delivery pipelines.

6. Comfort with both Linux and Windows server environments for security configuration, hardening, and ongoing maintenance.

Practical notes

1. This is a full-time role with a fixed work location in either Glasgow or Newbury / Reading, Berkshire.

2. The position requires occasional travel to other Bamboohr offices or client sites for security reviews and assessments.

3. Candidates must be eligible to work in the United Kingdom without the need for visa sponsorship.

4. The hiring process includes technical interviews, a practical security assessment, and a standard background check.