L3 Microsoft Purview Support (Security)

Key Responsibilities

• Provide L3 SME support for Microsoft Purview activities aligned to Information Protection, Data Loss Prevention, Insider Risk Management, and Data Lifecycle Management.
• Support go-live by advising on label publishing, DLP simulation or enforcement, IRM policy activation, retention policy deployment, and configuration evidence review.
• Provide Hypercare guidance for Purview issues, including DLP false positive or negative tuning, label policy behavior, IRM alert triage, retention behavior, and Sentinel or Splunk alert routing.
• Review screenshots, policy status, validation outputs, logs, and configuration evidence shared by client teams.
• Advise on warranty issues attributable to signed-off Purview design or build/configuration guidance.
• Coordinate with compliance, SOC, IT security, and operations stakeholders to validate issues, clarify remediation guidance, and track closure.
• Maintain issue logs, advisory notes, RAID updates, resolution summaries, and phase closure inputs.

Skill and experiences

• Min 5+ years supporting Microsoft Purview in large enterprise security or compliance environments.

• Hands-on knowledge of Purview Information Protection labels, DLP policies, Insider Risk Management scenarios, and Data Lifecycle Management retention policies.

• Ability to advise on signed-off Purview design and build guidance across Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams locations.

• Familiarity with Microsoft built-in Sensitive Information Types, SOC integration touchpoints, Sentinel or Splunk routing, and Purview issue tracking.

• Strong understanding of go-live, Hypercare, warranty support, stakeholder evidence review, and L3 escalation handling.

• Able to lead technical conversations with compliance, SOC, IT security, and operations stakeholders

• Experience working with client-facing delivery teams and coordinating with compliance, SOC, IT security, and operations teams is beneficial

• Strong ownership, clear advisory communication, structured issue management, and practical judgment when guiding configuration evidence review, remediation options, and support closure activities

• Desirable Microsoft certifications include SC-200, MD-102, SC-900, AZ-500, SC-300, SC-401.