L3 Microsoft Purview Support (Security)
Key Responsibilities
- Provide L3 SME support for Microsoft Purview activities aligned to Information Protection, Data Loss Prevention, Insider Risk Management, and Data Lifecycle Management.
- Support go-live by advising on label publishing, DLP simulation or enforcement, IRM policy activation, retention policy deployment, and configuration evidence review.
- Provide Hypercare guidance for Purview issues, including DLP false positive or negative tuning, label policy behavior, IRM alert triage, retention behavior, and Sentinel or Splunk alert routing.
- Review screenshots, policy status, validation outputs, logs, and configuration evidence shared by client teams.
- Advise on warranty issues attributable to signed-off Purview design or build/configuration guidance.
- Coordinate with compliance, SOC, IT security, and operations stakeholders to validate issues, clarify remediation guidance, and track closure.
- Maintain issue logs, advisory notes, RAID updates, resolution summaries, and phase closure inputs.
Skill and experiences
Min 5+ years supporting Microsoft Purview in large enterprise security or compliance environments.
Hands-on knowledge of Purview Information Protection labels, DLP policies, Insider Risk Management scenarios, and Data Lifecycle Management retention policies.
Ability to advise on signed-off Purview design and build guidance across Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams locations.
Familiarity with Microsoft built-in Sensitive Information Types, SOC integration touchpoints, Sentinel or Splunk routing, and Purview issue tracking.
Strong understanding of go-live, Hypercare, warranty support, stakeholder evidence review, and L3 escalation handling.
Able to lead technical conversations with compliance, SOC, IT security, and operations stakeholders
Experience working with client-facing delivery teams and coordinating with compliance, SOC, IT security, and operations teams is beneficial
Strong ownership, clear advisory communication, structured issue management, and practical judgment when guiding configuration evidence review, remediation options, and support closure activities
Desirable Microsoft certifications include SC-200, MD-102, SC-900, AZ-500, SC-300, SC-401.