Microsoft Purview Engineer

Role Title: Microsoft Purview Engineer
Department / Seat Name: TAC
Engagement Type: Independent Contractor (1099), project-scoped

Role Summary
The Microsoft Purview Engineer is a hands-on Microsoft 365 security engineer who owns the
technical execution of Purview data protection engagements for RSI Security clients. This role
assesses current-state Microsoft 365 and Purview configuration, designs the data classification
and sensitivity-labeling architecture, defines and implements DLP policies and use cases, and
works directly with client business departments to translate their data requirements into
working Purview controls. The role also performs Microsoft 365 / O365 security configuration
assessments across Exchange, Teams, SharePoint, OneDrive, Entra ID, and Defender for Office
365. This is an implementation and engineering seat, not an advisory one — the contractor is
expected to be in the tenant, building and testing configurations, not producing
recommendations for someone else to execute.

Role Purpose
The purpose of this role is to give RSI Security the depth of Microsoft platform expertise
required to take client Purview deployments past initial discovery and into production. Clients
engaging RSI for this work have typically completed baseline data scanning and begun testing
DLP policies on their own, and need a practitioner who can assess what they have built,
correct it, and carry the deployment to a validated, operational state. The contractor is
expected to hold the technical conversation directly with client IT and security staff on
implementation options, trade-offs, and Microsoft platform practices, and to defend the design
decisions made.

Core Responsibilities
● Assess current-state Microsoft Purview and Microsoft 365 configuration, including
existing data discovery results, scan coverage, label taxonomy, and in-flight DLP
policies, and document gaps against the client's data protection objectives.
● Develop a Purview implementation roadmap and phased deployment plan, sequenced
against client readiness, licensing, and business department availability.
● Design the data classification framework and sensitivity label structure, including label
scoping, publishing policies, auto-labeling rules, and encryption and access-control
settings.
● Define, configure, test, and tune DLP policies across Exchange Online, Teams,
SharePoint Online, OneDrive, and endpoint, including policy simulation, false-positive
reduction, and user-notification and override behavior.
● Configure and validate Microsoft Purview Information Protection, data lifecycle and
retention policies, and Insider Risk Management, matched to the client's
records-retention and regulatory obligations.
● Facilitate working sessions with client business departments to identify data types,
ownership, handling requirements, and acceptable friction, and translate those into
Purview policy configuration.
● Design and validate data protection controls for PII, PHI, and other sensitive
government data, including controls governing Microsoft Copilot access to sensitive
content where the client has Copilot deployed.
● Execute Microsoft 365 / O365 security configuration assessments covering tenant-level
security posture, Entra ID identity and conditional access, Exchange Online protection,
Defender for Office 365, SharePoint and OneDrive external sharing, Teams governance,
and audit and logging configuration.
● Produce technical findings, configuration evidence, and remediation guidance in RSI
report format, at delivery quality suitable for direct client release.
● Establish ongoing operational processes and handoff documentation so client staff can
administer, monitor, and extend the Purview deployment after the engagement closes.
● Participate in client technical meetings and answer implementation and
platform-practice questions directly, including trade-off discussion on licensing, scope,
phasing, and control strictness.
● Provide accurate time and activit