Microsoft Purview Engineer

Role Title: Microsoft Purview Engineer Department / Seat Name: TAC Engagement Type: Independent Contractor (1099), project-scoped Role Summary The Microsoft Purview Engineer is a hands-on Microsoft 365 security engineer who owns the technical execution of Purview data protection engagements for RSI Security clients. This role assesses current-state Microsoft 365 and Purview configuration, designs the data classification and sensitivity-labeling architecture, defines and implements DLP policies and use cases, and works directly with client business departments to translate their data requirements into working Purview controls. The role also performs Microsoft 365 / O365 security configuration assessments across Exchange, Teams, SharePoint, OneDrive, Entra ID, and Defender for Office 365. This is an implementation and engineering seat, not an advisory one — the contractor is expected to be in the tenant, building and testing configurations, not producing recommendations for someone else to execute. Role Purpose The purpose of this role is to give RSI Security the depth of Microsoft platform expertise required to take client Purview deployments past initial discovery and into production. Clients engaging RSI for this work have typically completed baseline data scanning and begun testing DLP policies on their own, and need a practitioner who can assess what they have built, correct it, and carry the deployment to a validated, operational state. The contractor is expected to hold the technical conversation directly with client IT and security staff on implementation options, trade-offs, and Microsoft platform practices, and to defend the design decisions made. Core Responsibilities ● Assess current-state Microsoft Purview and Microsoft 365 configuration, including existing data discovery results, scan coverage, label taxonomy, and in-flight DLP policies, and document gaps against the client's data protection objectives. ● Develop a Purview implementation roadmap and phased deployment plan, sequenced against client readiness, licensing, and business department availability. ● Design the data classification framework and sensitivity label structure, including label scoping, publishing policies, auto-labeling rules, and encryption and access-control settings. ● Define, configure, test, and tune DLP policies across Exchange Online, Teams, SharePoint Online, OneDrive, and endpoint, including policy simulation, false-positive reduction, and user-notification and override behavior. ● Configure and validate Microsoft Purview Information Protection, data lifecycle and retention policies, and Insider Risk Management, matched to the client's records-retention and regulatory obligations. ● Facilitate working sessions with client business departments to identify data types, ownership, handling requirements, and acceptable friction, and translate those into Purview policy configuration. ● Design and validate data protection controls for PII, PHI, and other sensitive government data, including controls governing Microsoft Copilot access to sensitive content where the client has Copilot deployed. ● Execute Microsoft 365 / O365 security configuration assessments covering tenant-level security posture, Entra ID identity and conditional access, Exchange Online protection, Defender for Office 365, SharePoint and OneDrive external sharing, Teams governance, and audit and logging configuration. ● Produce technical findings, configuration evidence, and remediation guidance in RSI report format, at delivery quality suitable for direct client release. ● Establish ongoing operational processes and handoff documentation so client staff can administer, monitor, and extend the Purview deployment after the engagement closes. ● Participate in client technical meetings and answer implementation and platform-practice questions directly, including trade-off discussion on licensing, scope, phasing, and control strictness. ● Provide accurate time and activity documentation sufficient to support invoicing and deliverable verification. Required Technical Qualifications ● Strong hands-on Microsoft Purview implementation experience — deployments carried to production, not pilots or assessments alone ● Data discovery and classification, including content scanning, sensitive information types, exact data match, and trainable classifiers ● Sensitivity labels and Microsoft Purview Information Protection (formerly MIP), including label policy design, auto-labeling, and encryption behavior ● DLP policy design, configuration, testing, and tuning across Microsoft 365 workloads ● Data governance, data lifecycle management, and retention policy configuration ● Insider Risk Management configuration and tuning ● Administration-level command of Microsoft 365 workloads: Exchange Online, Teams, SharePoint Online, and OneDrive ● Demonstrated experience building data classification frameworks from the ground up ● Demonstrated experience translating business requirements into working Purview policy configuration ● Demonstrated experience facilitating requirements workshops across multiple business departments ● Ability to produce an implementation roadmap and phased deployment plan and execute against it ● Experience protecting PII, PHI, and other highly sensitive data in regulated environments ● Microsoft 365 administrator or security engineer background, evidenced by current or recent certification (MS-500 / SC-400 / SC-401, SC-200, SC-300, or MS-102) or equivalent demonstrable production experience Preferred Qualifications ● Microsoft 365 GCC or GCC High experience ● Government sector experience, including public agency, housing authority, or state and local government environments ● Microsoft 365 G5 licensing experience and command of which Purview capabilities each license tier unlocks ● Microsoft Copilot data protection and security experience ● PowerShell automation across Exchange Online, Security & Compliance, and Graph ● Prior consulting or client-facing delivery experience in a professional services environment