First, I would isolate the Device by disconnect the compromised device from the company's network to prevent data leakage or further spread of malware. For instance, disable Wi-Fi and VPN access immediately. Revoke the employee’s access to company systems through mobile device management (MDM) or identity platforms like Microsoft Azure AD or Okta to prevent unauthorized access. Launch the incident response plan by running endpoint detection and response (EDR) tools like CrowdStrike or SentinelOne to identify and mitigate threats across all devices. Conduct Malware Analysis Analyse the app to understand its behaviour and determine what data might have been compromised. This can be done by sandbox environment to monitor the app's activities.

You don't say if this is a company device or a private device. If it's company, more fool you for allowing staff to install apps. If it's private, do what we did and ban mobiles in the office. There's no need for them to be there. They can get their email online and you can protect that. Don't allow BYOD. After that it's normal rules for sharing company data i.e. illegal or sackable depending your policy.