Microsoft Purview Engineer

Microsoft Purview Engineer Offshore (US Hours)

Location: Offshore / Remote — must work core US business hours

Employment type: Consultant

Team: Corporate Services

Role Summary

We're hiring a Microsoft Purview Engineer to build, operate, and harden data protection and compliance controls across our Microsoft 365 E5 estate and our structured data sources. You'll own the day-to-day engineering of sensitivity labeling, data loss prevention, retention, and eDiscovery on the M365 side; stand up Data Security Posture Management for AI (DSPM for AI) to govern Copilot, ChatGPT, Clause and other LLMs and generative-AI data exposure; and drive PII discovery and classification in structured data (SQL Server) through the Purview Data Map. You'll partner with security, legal, data, and IT teams during overlapping hours. This is a hands-on build-and-run role for someone who can take a compliance requirement and translate it into working, policy-as-configuration controls — across both unstructured and structured data — without hand-holding.

Job Description:

Information Protection

• Design, deploy, and tune sensitivity labels, label policies, and auto-labeling (client- and service-side) across Exchange, SharePoint, OneDrive, and Teams.
• Configure encryption, content marking, and access controls; troubleshoot labeling and decryption issues end to end.

Data Loss Prevention (DLP)

• Author and maintain DLP policies across Exchange, SharePoint/OneDrive, Teams, and Endpoint DLP (Intune-managed devices).
• Build and validate sensitive information types (SITs), exact data match (EDM), and trainable classifiers; reduce false positives through iterative tuning.

Data Lifecycle & Records Management

• Implement retention labels and policies, disposition review, and records management for regulatory and legal-hold requirements.

eDiscovery & Investigations

• Run eDiscovery (Standard and Premium), content search, and legal hold; support legal and HR on collections and exports.

Insider Risk & Communication Compliance

• Configure and triage Insider Risk Management policies and Communication Compliance reviews in partnership with HR and Legal.

Data Security Posture Management for AI (DSPM for AI)

• Deploy and operate Purview DSPM for AI to discover and monitor how sensitive data is exposed to Microsoft 365 Copilot, Copilot Studio agents, and third-party generative-AI apps.
• Run oversharing and data-risk assessments; identify SharePoint/OneDrive content over-accessible to Copilot and drive remediation (sensitivity labels, access reviews, SharePoint Advanced Management).
• Configure one-click and custom AI policies (DLP for Copilot, risky-AI-interaction detection); audit AI prompts and responses via Activity Explorer and Communication Compliance.

Structured Data Discovery & Classification (SQL Server)

• Register and scan SQL Server sources (on-prem via self-hosted integration runtime, and Azure SQL) in the Microsoft Purview Data Map; configure scan rule sets and schedules.
• Run classification scans to discover PII in structured data; tune built-in and custom classifiers (regex/dictionary) to accurately flag personal, financial, and health data at the column level.
• Profile and validate findings directly in SQL Server with T-SQL — sampling columns, confirming true/false positives, and producing remediation and data-owner assignment lists.
• Bridge structured findings to M365 controls — e.g., extract sensitive value sets from SQL Server to build Exact Data Match (EDM) schemas that power DLP and labeling.
• Maintain the data catalog, classifications, and lineage; surface PII posture into Data Security Posture Management (DSPM) views.

Operations & Governance

• Monitor alerts in the Purview portal and Microsoft Defender; investigate and remediate policy violations.
• Maintain Compliance Manager assessments and evidence; support audits.
• Automate recurring tasks via Security & Compliance PowerShell and Microsoft Graph.
• Document architecture, runbooks, and change records; participate in change management for production policy changes.

Required Qualifications

• 4+ years in security/compliance engineering, with 2+ years hands-on Microsoft Purview (compliance/information protection workloads).
• Demonstrated experience with sensitivity labels, DLP, and retention in a production M365 E5 tenant.
• Working knowledge of the broader M365 security stack: Entra ID, Intune, Microsoft Defender (Endpoint / Cloud Apps), and Exchange Online.
• Proficiency with Security & Compliance PowerShell; comfort scripting and automating policy operations.
• Solid grasp of data classification concepts (SITs, EDM, trainable classifiers) and how labeling/DLP behave across M365 services.
• Hands-on with the Microsoft Purview Data Map for structured sources — registering and scanning SQL Server (including self-hosted integration runtime for on-prem), scan rule sets, and classification of PII at the column level.
• Working SQL / T-SQL proficiency — able to profile tables and columns, sample data, and validate PII classification findings directly in SQL Server.
• Experience with, or demonstrable readiness to operate, DSPM for AI / Copilot data-security oversight (oversharing assessments, AI DLP, AI interaction auditing).
• Ability to investigate incidents independently and write clear documentation.
• Reliable overlap with US business hours and strong written/verbal English for async and live collaboration with US teams.

Preferred Qualifications

• Endpoint DLP at scale and DLP for Defender for Cloud Apps (non-Microsoft SaaS).
• Microsoft 365 Copilot deployment/governance and SharePoint Advanced Management (restricted content discovery, site access reviews, restricted search).
• Insider Risk Management and Communication Compliance configuration.
• eDiscovery Premium workflows and legal-hold operations.
• Data Map scanning beyond SQL Server (Azure SQL, Azure Storage, Fabric, Snowflake, or other multicloud sources) and data lineage.
• Stronger data background — relational data modeling, profiling large tables for PII, and reasoning about classification accuracy at scale.
• Microsoft Graph (Security API) automation; Logic Apps or Sentinel integration.
• Exposure to regulated environments (e.g., HIPAA, PCI-DSS, GLBA, or SEC/FINRA records requirements).

Certifications (a plus, not required)

• SC-400: Information Protection and Compliance Administrator
• SC-200: Security Operations Analyst
• SC-300: Identity and Access Administrator
• MS-102 / AZ-500 also valued

Working Model & Hours

• Remote, offshore. You must maintain a consistent daily overlap with US business hours (9-5 PM US ET).
• Participate in US-aligned standups, change windows, and incident response.
• Occasional after-hours support for production changes or incidents, on a rotating basis.