Senior Data Security Engineer - Purview & AI Governance

What This Role Is Expected to Deliver

Build and mature Onit's Microsoft Purview information protection and DLP capabilities across Microsoft 365 and endpoints.
Improve protection of sensitive data across SharePoint, OneDrive, Teams and endpoints, including labeling, access/oversharing risk and data lifecycle controls.
Make the Microsoft 365 data estate safer for generative AI and other approved AI tools and use cases by understanding what AI can access and where sensitive data may be exposed.
Translate emerging AI/data-governance requirements into practical technical controls, operating processes and measurable improvements.
Implement and operationalize any CASB, SSPM, DSPM and Shadow AI discovery/governance solutions to identify risk, enforce controls, remediate exposure and improve SaaS/AI security posture.

Key Responsibilities

Design, implement, tune and operate Microsoft Purview Data Loss Prevention (DLP), including Microsoft 365 and Endpoint DLP scenarios.
Own Microsoft Purview Information Protection capabilities including sensitivity labels, publishing policies, auto-labeling, Sensitive Information Types (SITs), trainable/classification concepts and policy tuning.
Implement and support retention, records/data lifecycle, legal hold, Content Search, Core/Advanced eDiscovery workflows, audit and evidence-preservation processes where required.
Partner with business, legal, privacy, security and IT stakeholders to translate data-protection requirements into workable Purview policies without creating excessive user friction or false positives.
Assess and improve sensitive-data exposure across SharePoint, OneDrive and Teams, including oversharing, external sharing, broad group access and inherited/direct permissions in collaboration with M365 platform owners.
Support data-security readiness for Microsoft Copilot, Claude, Anthropic, Cursor and other enterprise AI tools by identifying sensitive content exposure, access pathways and control gaps before broader AI enablement.
Develop capability in AI data security and governance areas such as DSPM for AI, Shadow AI discovery, sanctioned/unsanctioned AI use, prompt/data leakage risk, AI application inventory and policy/control mapping.
Work with CASB/SSE/SASE or SaaS discovery capabilities where they contribute to identifying Shadow AI/Shadow IT and controlling risky data movement; deep SAM/licensing expertise is not a requirement for this role.
Use PowerShell, Microsoft Graph and Microsoft 365 reporting capabilities to automate policy validation, reporting, investigation support and recurring operational tasks.
Own complex L3 troubleshooting for Purview/DLP policy behavior, classification, labeling, endpoint DLP, eDiscovery/legal-hold and Microsoft 365 data-protection issues.
Evaluate new Microsoft Purview, Copilot security and AI-governance capabilities through structured lab/POV testing and recommend production adoption based on risk reduction and operational value.
Create technical designs, SOPs, runbooks and decision records; mentor IT team members and transfer data-security knowledge across the team.
Lead data-security and AI-governance projects from requirements and pilot through rollout, change communication, validation and steady-state handover.

Required Skills - Must Have

Strong hands-on Microsoft Purview experience in an enterprise Microsoft 365 environment.
Hands-on DLP experience, including policy design/tuning and practical understanding of false positives, exceptions and business impact.
Strong Information Protection experience: sensitivity labels, publishing, auto-labeling and classification/Sensitive Information Type concepts.
Hands-on experience with retention, legal hold/eDiscovery, audit or related Microsoft Purview data lifecycle/investigation capabilities.
Microsoft Purview DSPM / Data Security Posture Management and AI data-security capabilities.
CASB/SSE/SASE, Shadow IT or Shadow AI discovery/control concepts.
Strong understanding of SharePoint, OneDrive and Teams as data repositories and how permissions/sharing affect data security.
Working Microsoft Entra ID knowledge sufficient to understand identity, group membership and access dependencies that affect data protection.
Strong L3 troubleshooting and analytical skills across Purview, Microsoft 365 and data-security controls.
Ability to independently plan and execute technical projects/changes, including requirements, pilot, stakeholder communication, risk management, validation and documentation.
Strong written and verbal communication, particularly the ability to explain data-security controls to technical and non-technical stakeholders.

Adjacent Skills - Good to Have / Learn Quickly

Leading AI Tools security/readiness, generative-AI data exposure assessment or AI application governance.
AI governance frameworks such as ISO/IEC 42001, NIST AI RMF, Responsible AI principles or similar governance models.
PowerShell and Microsoft Graph automation for Microsoft 365/Purview operations.
Privacy/regulatory environments such as GDPR and ISO 27001; exposure to legal/compliance workflows is useful.
SaaS discovery, SSPM or SAM concepts are useful adjacent knowledge.
Demonstrates learnability: can move from an unfamiliar security/governance requirement to research, lab/POV, production design, implementation, documentation and knowledge transfer.
Shows evidence of expanding beyond one Microsoft Purview feature into broader data-security, cloud-security or AI-security responsibilities.

What Success Looks Like

Takes technical ownership of all Data security, AI Governance, Purview DLP, labels and data lifecycle/eDiscovery capabilities and reduces dependency on external expertise.
Improves the organization's visibility and control of sensitive data across Microsoft 365 and endpoints.
Builds practical AI data-security capability around Copilot/GenAI readiness, Shadow AI and sensitive-data exposure rather than remaining a traditional DLP-only specialist.
Turns new data-security and AI-governance requirements into implemented, documented and supportable controls.

Experience & Qualifications

9+ years relevant experience across enterprise IT, Microsoft 365, endpoint/security or related infrastructure disciplines.
Demonstrated experience owning production systems and resolving complex technical problems, not only following predefined operational procedures.
Experience working with distributed/global stakeholders and managing technical changes across business teams is preferred.
Bachelor's degree or equivalent practical experience in Information Technology, Computer Science or a related discipline.

Preferred Certifications

Microsoft Certified: Information Security Administrator Associate (SC-401) - strongly preferred
Microsoft Purview / information protection / compliance certification experience (SC-400 legacy or equivalent) - advantage
Microsoft 365 Administrator / MS-102 - advantage