Microsoft Purview Engineer Offshore (US Hours)

Location: Offshore / Remote — must work core US business hours

Employment type: Consultant

Team: Corporate Services

Role Summary

We're hiring a Microsoft Purview Engineer to build, operate, and harden data protection and compliance controls across our Microsoft 365 E5 estate and our structured data sources. You'll own the day-to-day engineering of sensitivity labeling, data loss prevention, retention, and eDiscovery on the M365 side; stand up Data Security Posture Management for AI (DSPM for AI) to govern Copilot, ChatGPT, Clause and other LLMs and generative-AI data exposure; and drive PII discovery and classification in structured data (SQL Server) through the Purview Data Map. You'll partner with security, legal, data, and IT teams during overlapping hours.

This is a hands-on build-and-run role for someone who can take a compliance requirement and translate it into working, policy-as-configuration controls — across both unstructured and structured data — without hand-holding.

Information Protection

- Design, deploy, and tune sensitivity labels, label policies, and auto-labeling (client- and service-side) across Exchange, SharePoint, OneDrive, and Teams.
- Configure encryption, content marking, and access controls; troubleshoot labeling and decryption issues end to end.

Data Loss Prevention (DLP)

- Author and maintain DLP policies across Exchange, SharePoint/OneDrive, Teams, and Endpoint DLP (Intune-managed devices).
- Build and validate sensitive information types (SITs), exact data match (EDM), and trainable classifiers; reduce false positives through iterative tuning.

Data Lifecycle & Records Management

- Implement retention labels and policies, disposition review, and records management for regulatory and legal-hold requirements.

eDiscovery & Investigations

- Run eDiscovery (Standard and Premium), content search, and legal hold; support legal and HR on collections and exports.

Insider Risk & Communication Compliance

- Configure and triage Insider Risk Management policies and Communication Compliance reviews in partnership with HR and Legal.

Data Security Posture Management for AI (DSPM for AI)

- Deploy and operate Purview DSPM for AI to discover and monitor how sensitive data is exposed to Microsoft 365 Copilot, Copilot Studio agents, and third-party generative-AI apps.




- Run oversharing and data-risk assessments; identify SharePoint/OneDrive content over-accessible to Copilot and drive remediation (sensitivity labels, access reviews, SharePoint Advanced Management).
- Configure one-click and custom AI policies (DLP for Copilot, risky-AI-interaction detection); audit AI prompts and responses via Activity Explorer and Communication Compliance.

Structured Data Discovery & Classification (SQL Server)

- Register and scan SQL Server sources (on-prem via self-hosted integration runtime, and Azure SQL) in the Microsoft Purview Data Map; configure scan rule sets and schedules.
- Run classification scans to discover PII in structured data; tune built-in and custom classifiers (regex/dictionary) to accurately flag personal, financial, and health data at the column level.
- Profile and validate findings directly in SQL Server with T-SQL — sampling columns, confirming true/false positives, and producing remediation and data-owner assignment lists.
- Bridge structured findings to M365 controls — e.g., extract sensitive value sets from SQL Server to build Exact Data Match (EDM) schemas that power DLP and labeling.
- Maintain the data catalog, classifications, and lineage; surface PII posture into Data Security Posture Management (DSPM) views.

Operations & Governance

- Monitor alerts in the Purview portal and Microsoft Defender; investigate and remediate policy violations.
- Maintain Compliance Manager assessments and evidence; support audits.
- Automate recurring tasks via Security & Compliance PowerShell and Microsoft Graph.
- Document architecture, runbooks, and change records; participate in change management for production policy changes.

Required Qualifications

- 4+ years in security/compliance engineering, with 2+ years hands-on Microsoft Purview (compliance/information protection workloads).
- Demonstrated experience with sensitivity labels, DLP, and retention in a production M365 E5 tenant.
- Working knowledge of the broader M365 security stack: Entra ID, Intune, Microsoft Defender (Endpoint / Cloud Apps), and Exchange Online.




- Proficiency with Security & Compliance PowerShell; comfort scripting and automating policy operations.
- Solid grasp of data classification concepts (SITs, EDM, trainable classifiers) and how labeling/DLP behave across M365 services.
- Hands-on with the Microsoft Purview Data Map for structured sources — registering and scanning SQL Server (including self-hosted integration runtime for on-prem), scan rule sets, and classification of PII at the column level.
- Working SQL / T-SQL proficiency — able to profile tables and columns, sample data, and validate PII classification findings directly in SQL Server.
- Experience with, or demonstrable readiness to operate, DSPM for AI / Copilot data-security oversight (oversharing assessments, AI DLP, AI interaction auditing).
- Ability to investigate incidents independently and write explicit documentation.
- Reliable overlap with US business hours and strong written/verbal English for async and live collaboration with US teams.

Preferred Qualifications

- Endpoint DLP at scale and DLP for Defender for Cloud Apps (non-Microsoft SaaS).
- Microsoft 365 Copilot deployment/governance and SharePoint Advanced Management (restricted content discovery, site access reviews, restricted search).
- Insider Risk Management and Communication Compliance configuration.
- eDiscovery Premium workflows and legal-hold operations.
- Data Map scanning beyond SQL Server (Azure SQL, Azure Storage, Fabric, Snowflake, or other multicloud sources) and data lineage.
- Stronger data background — relational data modeling, profiling large tables for PII, and reasoning about classification accuracy at scale.
- Microsoft Graph (Security API) automation; Logic Apps or Sentinel integration.
- Exposure to regulated environments (e.g., HIPAA, PCI-DSS, GLBA, or SEC/FINRA records requirements).

Certifications (a plus, not required)

- SC-400: Information Protection and Compliance Administrator
- SC-200: Security Operations Analyst
- SC-300: Identity and Access Administrator
- MS-102 / AZ-500 also valued

Working Model & Hours

- Remote, offshore. You must maintain a consistent daily overlap with US business hours (9-5 PM US ET).
- Participate in US-aligned standups, change windows, and incident response.
- Occasional after-hours support for production changes or incidents, on a rotating basis.

📌 Microsoft Purview Engineer (Gurugram)
🏢 Khoj Information Technology
📍 Gurugram