L3 Microsoft Purview Support (Security)

Primary Duties

• Deliver Level 3 Subject Matter Expert (SME) support for Microsoft Purview initiatives related to Information Protection, Data Loss Prevention, Insider Risk Management, and Data Lifecycle Management.
• Facilitate go-live processes by offering guidance on label publishing, DLP simulation or enforcement, activation of IRM policies, deployment of retention policies, and reviewing configuration evidence.
• Offer Hypercare support for Purview-related issues, which includes tuning for DLP false positives or negatives, analyzing label policy behavior, triaging IRM alerts, monitoring retention behavior, and managing Sentinel or Splunk alert routing.
• Examine screenshots, policy statuses, validation results, logs, and configuration evidence provided by client teams.
• Provide advice on warranty concerns linked to approved Purview design or build/configuration instructions.
• Collaborate with compliance, SOC, IT security, and operational stakeholders to verify issues, clarify remediation instructions, and ensure tracking to closure.
• Keep detailed logs of issues, advisory notes, RAID updates, resolution summaries, and inputs for phase closure.

Qualifications and Experience

• Minimum of 5 years of experience supporting Microsoft Purview in extensive enterprise security or compliance settings.

• Practical knowledge of Purview Information Protection labels, DLP policies, Insider Risk Management scenarios, and Data Lifecycle Management retention policies.

• Capability to provide guidance on approved Purview design and build recommendations across Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams environments.

• Knowledge of Microsoft’s built-in Sensitive Information Types, integration points with SOC, routing in Sentinel or Splunk, and tracking of Purview issues.

• Comprehensive understanding of go-live processes, Hypercare support, warranty assistance, stakeholder evidence review, and Level 3 escalation management.

• Proficient in leading technical discussions with compliance, SOC, IT security, and operational stakeholders.

• Experience collaborating with client-facing delivery teams and working in coordination with compliance, SOC, IT security, and operations teams is advantageous.

• Strong sense of ownership, effective advisory communication, organized issue management, and practical judgment in guiding configuration evidence review, remediation strategies, and support closure tasks.

• Desirable Microsoft certifications may include SC-200, MD-102, SC-900, AZ-500, SC-300, SC-401.