Security Lead w Wrocław, Polska

Security Lead

Miejsce pracy: Wrocław

Technologies we use

Expected

• Microsoft 365
• Microsoft Entra
• Microsoft Entra ID

About the project

In Cyclad we work with top international IT companies in order to boost their potential in delivering outstanding, cutting edge technologies that shape the world of the future. Currently, we are looking for an experienced Security Workstream Lead to take ownership of security operations and governance for enterprise-scale AI agents and Copilot solutions.

The role focuses on implementing a security-by-design approach across the Microsoft Copilot ecosystem and establishing a robust operating model for AI agents, governance, monitoring, and security operations.

You will work at the intersection of AI security, identity and access management, data protection, threat detection, and IT service management, helping translate security concepts into operational processes used by enterprise IT and security teams.

Project information:

Location: Remotely

Type of employment: B2B contract

Remuneration: 160 - 180 PLN net + VAT per hour on B2B

Project languages: English

Your responsibilities

• Define the security architecture and control framework for Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry.
• Establish and operationalize the security model for enterprise AI agents, including alignment between agent governance, observability, monitoring, and security functions.
• Define clear ownership and responsibilities across security, governance, monitoring, and operational teams.
• Design and implement identity and access governance using Microsoft Entra, Entra Agent ID, and least-privilege access principles.
• Operationalize Microsoft Purview capabilities, including data protection, sensitivity labeling, and DLP, together with Microsoft Defender and Microsoft Sentinel for agent-related threat detection and incident response.
• Integrate AI agent operations into existing ITIL/ITSM processes, covering incident, problem, change, and service request management.
• Define ownership models, RACI matrices, operational procedures, runbooks, and formal handover processes for IT operations and security teams.
• Support the validation of security controls through PoC activities, including agent discovery and inventory, identity lifecycle management, sensitive-data protection, threat detection, auditability, and access revocation.
• Ensure that security controls are not only technically implemented but also translated into repeatable and sustainable operational processes.

Our requirements

• Strong experience with Microsoft 365 security and administration.
• Practical knowledge of enterprise security frameworks, governance, and security-by-design principles.
• Experience with Microsoft Security Copilot and the broader Microsoft AI security ecosystem.
• Hands-on knowledge of Microsoft Defender and related security capabilities.
• Experience with Microsoft Entra / Entra ID and identity and access governance.
• Understanding of Microsoft Purview, data protection, DLP, and information governance.
• Familiarity with Microsoft Sentinel and security monitoring / incident response.
• Experience designing security controls and translating them into operational processes.
• Knowledge of ITIL / ITSM practices and enterprise service management.
• Ability to define RACI models, operational procedures, and security runbooks.
• Strong communication and stakeholder management skills, with the ability to coordinate across security, infrastructure, application, and operations teams.

What we offer

• Private medical care with dental care (covering 70% of costs). Family package option possible
• Multisport card (also for an accompanying person)
• Life insurance
• Work with talented engineers on large-scale, technically challenging projects

Benefits

• sharing the costs of sports activities
• private medical care
• life insurance
• remote work opportunities
• flexible working time
• integration events
• dental care
• no dress code

Cyclad

In Cyclad we work with top international IT companies in order to boost their potential in delivering outstanding, cutting edge technologies that shape the world of the future.

Please enclose the following statement in your application: I hereby give consent for my personal data contained in the submitted application documents to be processed by Cyclad sp. z o.o., ul. Chłodna 48/1, 00-872 Warszawa, including my image, in relation to my participation in the recruitment process. I acknowledge that the above consent may be withdrawn at any time.
If you are interested in participating in future recruitment processes, please enclose the following statement in your application: I hereby give consent for my personal data contained in the submitted application documents to be processed by Cyclad Sp. z o.o., Cyclad sp. z o.o., ul. Chłodna 48/1, 00-872 Warszawa, including my image, in relation to my participation in future recruitment processes. I acknowledge that the above consent may be withdrawn at any time. The Personal Data Controller is Cyclad Sp. z o.o., ul. Chłodna 48/1, 00-872 Warszawa, e-mail: [email protected], contact with the Data Protection Officer is available via e-mail: [email protected]. Personal data collected through job applications (CV) within the scope provided for in labor regulations shall be processed in order to allow performance of the ongoing recruitment pursuant to Art. 6(1)(a) of Regulation (EU) no. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (further referred to as GDPR). In case of giving consent to processing of data for future recruitment processes – personal data shall be processed under the consent, pursuant to Art. 6(1)(a) of the GDPR. If the Application form contains data referred to in Art. 9(1) of the GDPR, it shall be necessary to have the candidates consent for the processing of such data (Art. 9(2)(a) of the GDPR). The consent can be revoked at any time. Withdrawal of the consent shall not affect the lawfulness of the processing that had been performed under the consent prior to its withdrawal. Personal data provided by the candidate related to: - participation in a selected recruitment process will be stored until the recruitment process is completed for a given position, - participation in future recruitment processes will be stored until the candidate's consent to the processing of their data for this purpose is withdrawn, no longer, however, than for 5 years since the last update of the candidate’s data. Personal data may be disclosed to employees or associates of the Company, entities providing support to the Company on the basis of outsourced services or in accordance with data processing agreements, to entities authorized under the law, as well as to entities collaborating with the Company within the scope of job placement, in order to conduct recruitment processes. After the employee’s consent, personal data may also be disclosed to a potential employer for whom the recruitment process is being conducted. Submission of the candidate’s personal data within the scope under Art. 221 of the Labor Code is obligatory for participation in the recruitment process. Submission of other data by the candidate is voluntary. No submission of personal data within the required scope or objection to the processing of such data shall result in lack of possibility to include the Application in the recruitment processes conducted by the Company. The candidate has the right to access and rectify the contents of their data, remove such data, limit its processing, transfer such data, submit objection to the processing and revoke the consent at any time, without affecting the lawfulness of the processing conducted under such consent before it was withdrawn. The candidate also has the right to file a complaint with the President of the Office for Personal Data Protection when they consider the processing of their personal data to be a violation of the provisions of the GDPR.