Microsoft Purview and DLP Engineer L3
VaporVM
Role:We are seeking an experienced Microsoft Purview and DLP Engineer L3 to provide advanced administration, engineering, monitoring, and investigation support across enterprise data protection platforms. The ideal candidate will have strong hands-on expertise in Microsoft Purview, Data Loss Prevention (DLP), Insider Risk Management (IRM), and security operations, with experience integrating data protection solutions with SIEM, SOAR, and data governance platforms.
Key Responsibilities
Administer, configure, maintain, and troubleshoot Microsoft Purview, including sensitivity labels, data classification, encryption, DLP policies, and Insider Risk Management.
Implement and optimize data protection controls across Microsoft 365 environments and supported endpoints.
Identify control coverage gaps, conduct policy testing, reduce false positives, and implement approved policy enhancements.
Develop and maintain KQL queries and detection use cases for threat hunting, monitoring, and reporting.
Integrate Microsoft Purview, DLP, and IRM with SIEM and SOAR platforms, including IBM QRadar.
Develop automated investigation and response workflows using Microsoft Security Copilot.
Monitor security alerts, conduct L3-level investigations, handle MSSP escalations, and coordinate remediation activities.
Collaborate with endpoint, identity, messaging, application, infrastructure, data governance, and compliance teams.
Maintain operational runbooks, audit evidence, configuration records, risk registers, and exception documentation.
Prepare weekly progress updates and monthly reports covering security incidents, control coverage, compliance, and remediation activities.
Required Skills & Qualifications
Bachelor's degree in Computer Science, Information Technology, Electronics Engineering, or a related discipline.
5–6 years of relevant cybersecurity experience, with strong hands-on expertise in Microsoft Purview, DLP, and Insider Risk Management.
Strong knowledge of Microsoft 365 security, data classification, sensitivity labels, encryption, and endpoint/cloud DLP.
Proficiency in KQL and PowerShell for querying, automation, troubleshooting, and security investigations.
Hands-on experience integrating Microsoft Purview, DLP, and IRM with:
IBM QRadar SIEM
Collibra – Data Governance
SOAR platforms
Understanding of alert forwarding, security use-case onboarding, automated response workflows, and investigation processes.
Knowledge of role-based access control (RBAC), least privilege, change management, and secure evidence handling.
Strong troubleshooting, analytical, documentation, and stakeholder coordination skills.
Preferred Certifications
Microsoft Certified: Information Security Administrator Associate (SC-401) – Preferred.
Microsoft Certified: Security Operations Analyst Associate (SC-200) – Advantageous.
