Microsoft Purview

Microsoft Purview Engineer Jobs

12 jobs found

Today

Senior IT Support Engineer

Church's Texas Chicken Atlanta, GA

Atlanta, GA

Today

Full time Senior Azure Ad / Entra Id Computer Skills

Apply Now

Job Description

Senior IT Support Engineer roles at Church's Texas Chicken combine hands-on end-user support with deep technical engineering across endpoints, identity, applications, and security. This onsite position in Atlanta, GA gives you a clear escalation lane for complex problems while you help standardize controls across On-Premises, Cloud, and SaaS environments.

What You’ll Do

Serve as a key technical escalation point for complex issues across a global enterprise environment, applying independent judgment to determine remediation priority and approach. You will balance advanced engineering work (approximately 60–70% of the time) with tiered technical support (approximately 30–40% of the time).

Troubleshoot and remediate issues impacting Microsoft Secure Score pillars: Identity (authentication, Conditional Access), Data (protection in M365 and cloud SaaS), Applications (security and permissions), and Endpoints (Intune compliance).
Engineer and administer Microsoft Purview for data governance, compliance, and information protection, including sensitivity labels, data classification, and policy enforcement.
Enforce IT security policies, endpoint compliance, and Conditional Access controls consistently across On-Premises, Cloud, and SaaS.
Support endpoint protection tools such as Microsoft Defender.
Lead patching, vulnerability remediation, and security initiatives enterprise-wide.
Administer Microsoft Intune for device enrollment, compliance, patching, and application deployment, defining configuration standards and policy settings.
Act as Level 3 escalation for complex escalations and root cause analysis, driving systemic fixes company-wide.
Provide tiered support across Level 1 and Level 2 by diagnosing and resolving hardware, software, system, endpoint, network, and collaboration tool issues for onsite and remote users in hybrid work settings.
Troubleshoot enterprise applications, identity, and connectivity issues.
Manage incidents and service requests using ITSM tools such as ServiceNow and Freshservice, prioritizing by business impact and SLA requirements.
Perform root cause analysis and contribute to problem management initiatives.
Maintain knowledge base articles, SOPs, and technical documentation, ensuring thorough updates and communication throughout escalation stages to support efficient, SLA-driven resolution.
Manage endpoint lifecycle activities including imaging, deployment, upgrades, and support across Windows, macOS, iOS, and Android.
Manage IT asset lifecycle (deployment, tracking, auditing, retirement) using ITSM/asset tools, ensuring accurate inventory and ownership/location tracking.
Configure and support conference room technology such as Microsoft Teams Rooms, video conferencing systems, displays, and AV hardware, and troubleshoot collaboration room issues.
Provide end-user support and training for Microsoft 365, Teams, conferencing tools, and enterprise systems.
Promote security awareness and best practices, including MFA and phishing awareness.
Use AI tools to assist with troubleshooting, ticket triage, and knowledge management.

Required Qualifications

Bachelor’s degree in IT, Computer Science, or related field preferred (or equivalent experience).
5–7 years of IT support experience with progression into L2–L3 responsibilities.
3–5 years in a formal enterprise help desk/service desk environment.
Experience working with vendors and SLA-based support models.
2–3 years supporting hybrid cloud environments.
Experience supporting application integrations and technology rollouts.
Experience with asset lifecycle management and endpoint deployment.
Experience using AI tools to support troubleshooting and IT operations.
ITIL certification or proven hands-on experience applying ITIL frameworks, including incident, problem, and change management within a structured service environment.
Microsoft skills including Microsoft 365, Azure AD / Entra ID, and Intune.
Endpoint support experience across Windows, macOS, iOS, and Android.
Networking fundamentals: TCP/IP, DNS, DHCP, VLANs, VPN, Wi-Fi.
Conference room and AV technology support experience.
Endpoint security experience with Microsoft Defender and Conditional Access.
ITSM tools: ServiceNow, Freshservice, Jira, or similar.
Scripting/automation using PowerShell and/or Python (preferred).
CompTIA A+, CompTIA Network+, or Microsoft Certified (MCP, MD-102, AZ-104) preferred.
Strong written and verbal communication, excellent customer service, and user engagement skills.
Highly organized, able to manage multiple priorities; self-motivated and able to work independently and collaboratively.

Technologies You’ll Work With

Microsoft Secure Score, Microsoft Purview, Microsoft Intune, Microsoft Defender, Microsoft 365, Azure AD, Entra ID, Conditional Access, On-Premises, Cloud, SaaS.
Microsoft Copilot and AI-driven platforms, AI-enabled support approaches.
ITSM/asset tools including ServiceNow, Freshservice, and Jira.
PowerShell, Python, and networking fundamentals: TCP/IP, DNS, DHCP, VLANs, VPN, Wi-Fi.
Microsoft Teams Rooms, Windows, macOS, iOS, Android.
ITIL.

Physical Requirements

Capable of fulfilling essential job duties, with or without reasonable accommodation.
Must be able to lift, install, and provide support for IT and AV equipment as necessary.

View full job page →

9d ago

Data Security Engineer

Corteva Agriscience Indianapolis, IN

Indianapolis, IN

9d ago

Full time Data Loss Prevention Data Loss Prevention Data Protection

Apply Now

Job Description

Corteva Agriscience is seeking a Data Security Engineer (hybrid) to build and operate large-scale data protection capabilities with Microsoft Purview.

Responsibilities

Develop, configure, and maintain DLP policies and labeling solutions across endpoints, email, cloud, and network environments using Microsoft Purview.
Create and continuously enhance DLP policies using input from customer feedback, business needs, and regulatory requirements.
Own DLP and data classification policy configuration, deployment, and ongoing maintenance.
Integrate DLP capabilities with SIEM, CASB, endpoint protection, and other security platforms.
Monitor and optimize technical components of the data protection program by tuning DLP rules to reduce false positives and manage exceptions.
Lead change management for DLP and data protection initiatives to support adoption and compliance.
Partner with security, IT, and business stakeholders to understand data flows, apply Purview capabilities, and align controls to business needs.
Collaborate with vendors to ensure alignment with industry best practices for data protection.
Assess data protection risks for both persistent and transit layers, then design sustainable mitigation strategies.
Document complex process flows and communicate technical details to both technical and non-technical audiences.
Stay current with emerging threats, technologies, and regulatory changes, and recommend updates to the DLP strategy.
Develop and run test plans for DLP solutions across development, staging, and production environments to support robust deployment and minimize risk.

Requirements

5+ years of experience in data loss prevention or data security engineering.
7+ years of experience in information security.
2+ years of experience in a senior-level engineering role.
Hands-on experience with Microsoft Purview Information Protection (MIP labels) and Purview DLP.
Hands-on experience with Enterprise DLP administration and configuration.
Hands-on experience integrating DLP with SIEM, CASB, and endpoint protection platforms.
Ability to lead technical projects and collaborate in a global environment.
Strong problem-solving, documentation, and communication skills.
Bachelor’s degree in Computer Science, Information Technology, or a related field (preferred but not required).

Technologies

Microsoft Purview
Microsoft Purview Information Protection (MIP labels)
Purview DLP
DLP
SIEM
CASB
Microsoft Azure
Microsoft O365

Location & Work Model

Indianapolis, IN (hybrid)
Alternative locations: Indianapolis, IN or Johnston, IA
Remotely within the United States for highly qualified individuals

Preferred Qualifications

CISSP (Certified Information Systems Security Professional)
CISM (Certified Information Security Manager)
Experience with Microsoft Azure and Microsoft O365

Benefits

Numerous development opportunities to build skills
Health benefits for you and your family on your first day of employment
Four weeks of paid time off and two weeks of well-being pay per year, plus paid holidays
Excellent parental leave with a minimum of 16 weeks for mother and father
Future planning with a competitive retirement savings plan and tuition reimbursement program

View full job page →

12d ago

Digital Security Engineer

Microsoft United States

United States

12d ago

$131k - $272k/yr Full time Azure Administrator Cloud Platforms Cloud Security

Apply Now

Job Description

Microsoft is seeking a Digital Security Engineer to strengthen security capabilities across a virtual sales, technical, partner, and consulting team. In this onsite role in the United States, you will help shape solution design and technical leadership efforts for XDR, zero trust, cloud security, and Microsoft Purview, with an emphasis on enabling clients to protect and govern sensitive data while meeting regulatory and privacy requirements.

What you’ll do

Serve as a subject matter expert delivering technical presentations, demonstrations, workshops, architecture design sessions, and production-ready pilots for Microsoft solutions, with focus on top-of-funnel customer acquisition and potentially new cloud technologies.
Coordinate complex solutions with internal and external partners across multiple Microsoft online services and solutions.
Support competitive strategy by leveraging partner and internal teams, and act as the voice of the customer by driving feedback, identifying blockers, and sharing insights and resource needs across communities to support customer outcomes and usage growth.
Identify and troubleshoot technical, architectural, and competitive blockers, and develop solutions for sales and usage decision blockers while helping ensure proposals are implemented, validated, and integrated into customer environments in line with Microsoft standards.
Prepare technical insights and key scenarios to drive the right technical and business solution outcomes.
Lead technical discussions against competitors in the security domain, including Microsoft and competitor offerings.
Demonstrate a willingness to invest in personal learning in cybersecurity alongside team members.

Required qualifications

Bachelor’s Degree in Computer Science, Information Technology, Engineering, or a related field AND 6+ years of technical pre-sales or technical consulting experience (or equivalent experience).
6+ years experience with cloud and hybrid, or on-premises infrastructures, architecture designs, migrations, industry standards, and/or technology management.
Certification in relevant (Microsoft or industry) technologies or disciplines, such as Microsoft Office 365; Power BI; Azure Administrator, Architecture, and Development exams; Cloud Platform Technologies; Information Security; Architecture.

Technologies you’ll work with

Microsoft Purview
Extended detection and response (XDR)
Zero trust
Microsoft Office 365
Power BI
Azure Administrator
Azure Architecture
Azure Development exams
Cloud Platform Technologies
Information Security
Architecture

Education and experience (additional or preferred)

Bachelor’s Degree in Computer Science, Information Technology, Engineering, or a related field AND 12+ years of technical pre-sales or technical consulting experience (or equivalent experience).
6+ years experience with cloud and hybrid, or on-premises infrastructures, architecture designs, migrations, industry standards, and/or technology management.
Certification in relevant (Microsoft or industry) technologies or disciplines (examples listed in the required qualifications).

Compensation

The typical base pay range across the U.S. is USD 130,900 - 251,900 per year.
Different ranges apply for specific locations. In the San Francisco Bay area and New York City metropolitan area, the base pay range is USD 165,600 - 272,300 per year.
Certain roles may be eligible for benefits and other compensation. Additional benefits and pay information are available at https://careers.microsoft.com/us/en/us-corporate-pay.

Application process

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

View full job page →

13d ago

Cybersecurity Platform Engineer

Link Snacks Minneapolis, MN

Minneapolis, MN

13d ago

$115k - $130k/yr Full time Cloud Platforms Cybersecurity Tools Data Governance

Apply Now

Job Description

Link Snacks is seeking a Cybersecurity Platform Engineer to support the Global IT organization. This onsite role focuses on building, configuring, automating, and continuously improving enterprise cybersecurity platforms, with technical ownership across Microsoft security capabilities, cloud security controls, and identity and access management (IAM).

Location and Compensation

Location: Minneapolis, MN (onsite)
Salary: USD 115,000 to 130,000 per year
Starting salary: $115,000.00 to $130,000.00; actual salaries vary based on external market data, internal equity, location, and candidate skill set and experience

Base pay is one component of Link Snacks Total Rewards.

Responsibilities

Lead engineering, administration, and continuous improvement of Microsoft Defender capabilities, including Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Identity, Defender XDR, and related security integrations.
Design, implement, and mature Microsoft Purview capabilities for data protection, information governance, data loss prevention, insider risk, eDiscovery support, retention, sensitivity labeling, and compliance-driven control enforcement.
Engineer cloud security controls across Microsoft Azure and Microsoft 365, including secure configuration baselines, cloud security posture management, workload protection, logging, alerting, policy enforcement, and remediation tracking.
Drive IAM engineering efforts covering Entra ID, Active Directory, Conditional Access, privileged access, access reviews, identity lifecycle automation, service accounts, guest access, and secure authentication patterns.
Develop automation, scripts, integrations, and repeatable processes to improve reliability, reduce manual effort, standardize controls, and support consistent enforcement across global environments.
Partner with security operations, MDR, SIEM, infrastructure, network, application, data, OT, and business teams to integrate cybersecurity platforms with detection, response, vulnerability management, incident response, and operational workflows.
Create and maintain security platform standards, configuration baselines, procedures, runbooks, diagrams, operational documentation, and audit-ready evidence aligned to regulatory and cybersecurity framework requirements.
Define and report platform health and security metrics such as control effectiveness, adoption, remediation progress, and secure configuration status for technical teams and leadership stakeholders.
Evaluate emerging platform capabilities, Microsoft security roadmap changes, cloud security trends, and industry best practices to recommend improvements that strengthen the organization’s security posture.
Perform other duties as assigned.

Required Qualifications

Education: Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or related field (or equivalent professional experience).
Experience: 4+ years of hands-on experience engineering, administering, or improving cybersecurity platforms across Microsoft security, cloud security, identity, endpoint, data protection, or security operations domains.
Strong foundation in cybersecurity platform engineering, including endpoint security, cloud security, IAM, data protection, compliance controls, automation, and incident response support.
Proficiency with Microsoft security and identity technologies, Windows, Linux, PowerShell, scripting, API-based integrations, and automation of security operations processes.
Experience with Microsoft Defender, Microsoft Purview, Microsoft Entra ID, Microsoft Intune, Active Directory, Microsoft Sentinel, and Microsoft 365 security and compliance capabilities.
Skilled in platform configuration, log analysis, alert tuning, dashboarding, control validation, secure baseline development, and remediation tracking.
Proven ability to secure both IT and OT networks, including incident response, alert triaging, and vulnerability management experience.
Proficiency managing identity and access controls, including Active Directory administration and privileged access management.
Ability to execute cybersecurity strategies and enforce technical policies across enterprise environments.
Experience working with security frameworks and standards such as ISO 27001, NIST CSF, and GDPR.
Ability to manage vendor relationships and coordinate with internal and external stakeholders on security incidents and compliance matters.
Strong understanding of cybersecurity principles, risk management, encryption, authentication, and access control.
In-depth knowledge of network and infrastructure security, including virtualization, wireless technologies, and email systems.
Familiarity with SIEM platforms, automated penetration testing tools, and cloud risk assessment methodologies.
Knowledge of security design, technical governance, and third-party auditing practices.
Ability to communicate complex technical issues to technical and non-technical audiences.
Demonstrated discretion when handling sensitive and confidential information.
Strong adaptability, time management, and independent problem-solving skills.
Ability to remain composed under pressure and provide after-hours support when necessary.
Willingness to travel up to 10% for training and business-related activities.

Preferred Qualifications

Experience serving as the primary engineer or platform owner for capabilities such as Microsoft Defender XDR, Microsoft Purview, Microsoft Sentinel, Defender for Cloud, Tenable Nessus, BeyondTrust, Palo Alto, or similar enterprise security technologies.
Experience developing scalable security platform roadmaps, improving control maturity, reducing manual operational effort, and translating security requirements into technical implementation plans.
Cybersecurity certifications such as CISSP, CISM, CompTIA Security+, CompTIA CySA+, Microsoft Security, or equivalent practical experience.
Experience securing OT/industrial networks in manufacturing or consumer packaged goods environments.
Familiarity with Power BI, Fabric, or similar tools for security data analysis and reporting.

Technologies

Microsoft Defender, Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Identity, Defender XDR
Microsoft Purview
Microsoft Azure, Microsoft 365
Entra ID, Active Directory, Conditional Access
PowerShell, API-based integrations
Microsoft Intune, Microsoft Sentinel, SIEM, MDR
Windows, Linux, eDiscovery, Data loss prevention, insider risk, sensitivity labeling
Secure baseline development, cloud security posture management, workload protection
Log analysis, alert tuning, dashboarding
Encryption, authentication
ISO 27001, NIST CSF, GDPR

Benefits

Medical, dental and vision benefits
Life and disability insurance
401k participation
Paid holidays
Paid time off
Annual incentive and program-specific awards

Work Environment

Plant/office setting with varying temperatures and noise levels
Exposure to manufacturing equipment movement and wet or slippery floors
Most work is conducted in a climate-controlled office
Travel may be required

Physical Demands

Regularly required to sit, use hands to finger, handle, or feel, and talk or hear
Occasionally required to stand, walk, and reach with hands and arms
Occasionally lift and/or carry up to twenty-five pounds
Specific vision abilities required include close vision

Equal Employment Opportunity and E-Verify

Link Snacks provides equal employment opportunity to all persons regardless of protected characteristics under federal, state, or local law
All information will be kept confidential according to EEO guidelines
Link Snacks participates in the federal E-Verify program to confirm identity and employment authorization for newly hired employees

View full job page →

1mo ago

IT Data Engineer

JE Dunn Kansas City, MO

Kansas City, MO

1mo ago Closed

Full time Backend Developer Analytics API

This position is no longer accepting applications (closed Oct 27, 2026).

Job Description

The IT Data Engineer will design, build, and maintain enterprise data capabilities using Microsoft Fabric, supporting a scalable architecture for data pipelines, governance, and accessibility. This onsite role in Kansas City focuses on reliable integrations, data validation, performance monitoring, and collaboration with data consumers and source system owners.

Role Overview

This position is responsible for implementing and maintaining the enterprise data architecture within Microsoft Fabric. The work includes creating scalable data pipelines, applying medallion architecture in lakehouses, and ensuring data quality through validation and transformation processes. The engineer also supports deployed machine learning models by maintaining dependable data pipelines for both model training and inference.

Key Responsibilities

Design and implement a data mesh architecture using Microsoft Fabric’s OneLake Lakehouses, including data governance and security measures
Establish data transformation processes to support data quality and consistency
Develop and maintain both synchronous (real-time) and batch data integration processes, including unidirectional and bidirectional data flows as required
Develop and maintain API and delta connections to enable system interoperability
Implement data validation processes to support successful data exchange between systems
Monitor system performance, compute resources, and storage utilization
Troubleshoot and resolve data pipeline failures and performance bottlenecks
Maintain comprehensive documentation covering data architecture, pipelines, and processes
Collaborate across departments to identify data synergies and opportunities
Monitor and maintain deployed machine learning models
Document machine learning model data dependencies, pipelines, and infrastructure requirements
Support machine learning model development by ensuring reliable data pipelines for model training and inference

Required Qualifications

Ability to perform work accurately and completely, and in a timely manner
Communication skills, verbal and written
Time management skills
Ability to prioritize multiple projects
Ability to drive change through innovation and process improvement
Ability to communicate to executive audiences and deliver results through influence
Proficiency in MS Office (Intermediate)
Proficiency in SQL (Intermediate)
Proficiency in Python (Intermediate)
Proficiency in Spark (Intermediate)
Experience implementing data mesh architecture and medallion models
Experience with various data integration patterns and technologies
Knowledge of data governance and security best practices

Preferred Knowledge, Skills, & Abilities

Experience developing and consuming REST APIs for data integration (Preferred)
Familiarity with Power BI and Microsoft Fabric (Preferred)
Experience with Microsoft Purview or similar data catalog and governance tools (Preferred)
Understanding of machine learning concepts and MLOps (Preferred)

Education & Experience

Minimum experience: 2 years
Education: Bachelor’s degree in computer science, data engineering, data science or related field
In lieu of the above requirements, equivalent relevant experience will be considered

Technology & Tools

Microsoft Fabric
Microsoft Fabric’s OneLake Lakehouses
SQL
Python
Spark
REST APIs
Power BI
Microsoft Purview

Autonomy & Decision-Making

Provides decisions on non-routine matters, offers recommendations to a supervisor, and refers exceptions to the supervisor.

Career Path

Senior Data Engineer

Location & Work Environment

Location: Kansas City, MO, US (onsite)
Normal office environment
Frequent activity: sitting, viewing a computer screen
Occasional activity: standing, walking, bending, reaching above shoulder
Must be able to lift up to 10 pounds
May require periods of travel

Additional Information

Applications are expected to be accepted for at least three business days and may continue until a qualified applicant is selected or the position is cancelled.
JE Dunn provides reasonable accommodations to qualified individuals with disabilities.
JE Dunn Construction will not sponsor an applicant for work visa status or employment authorization, and will not offer immigration-related support for this position.

Benefits

The benefits package aligned to this position is Professional Non-Union.

View full job page →

1mo ago

Senior Information Protection & AI Security Engineer

System One Lafayette, LA

Lafayette, LA

1mo ago Closed

$123k - $156k/yr Full time Senior Ai Security Cloud Platforms

This position is no longer accepting applications (closed Oct 21, 2026).

Job Description

The Senior Information Protection & AI Security Engineer role supports enterprise data protection, AI governance, and insider risk programs in a highly regulated financial services environment. The position emphasizes improving Microsoft Purview capabilities, implementing AI security guardrails, and strengthening insider threat detection controls.

Key Responsibilities

Support enterprise initiatives for information protection, AI governance, and insider risk within a highly regulated financial services setting.
Implement, configure, and continuously enhance Microsoft Purview capabilities, including AI security guardrails and insider threat detection controls.
Collaborate across Microsoft Purview Information Protection, Data Loss Prevention (DLP), Insider Risk Management, Communication Compliance, and data classification capabilities.
Implement security and governance controls for Microsoft Copilot and other generative AI platforms to reduce the risk of sensitive data exposure, oversharing, prompt-based attacks, and unauthorized AI usage.
Partner with Security Operations, Incident Response, Compliance, Technology, and business teams to strengthen information protection controls and improve insider threat detection.
Build security automation, monitoring, metrics, and operational documentation using PowerShell, Microsoft Graph API, KQL, Microsoft Sentinel, and related components of the Microsoft security ecosystem.
Create security dashboards, metrics, reporting, standards, procedures, and operational runbooks.

Required Qualifications

8+ years of experience in cybersecurity, information protection, data security, or enterprise security engineering, including 5+ years of hands-on Microsoft Purview experience.
Strong experience configuring and tuning Microsoft Purview, including Information Protection, DLP, Insider Risk Management, Communication Compliance, data classification, and sensitivity labels.
Experience implementing AI security and governance controls for enterprise generative AI platforms, including Microsoft Copilot.
Knowledge of GenAI security risks, including sensitive data leakage, oversharing, unauthorized AI usage, and prompt injection.
Experience developing and tuning insider threat and data exfiltration detection policies to improve detection accuracy and reduce false positives.
Understanding of the Microsoft 365 Security and Compliance ecosystem.
Experience with Microsoft Defender, Microsoft Sentinel, Entra ID, Azure, and Microsoft Graph API.
Ability to develop security and operational automation using PowerShell, Microsoft Graph API, KQL, or similar technologies.
Experience creating security dashboards, metrics, reporting, standards, procedures, and operational runbooks.
Strong understanding of information governance, data classification, security controls, and regulatory compliance in large enterprise environments.
Experience collaborating with Security Operations, Incident Response, Compliance, engineering, and business teams.
Experience in financial services, regulated industries, or other highly sensitive enterprise environments is strongly preferred.

Preferred Certifications

Relevant certifications such as SC 400, SC 100, SC 200, SC 300, CISSP, CISM, or GIAC are preferred.
Preferred certifications include Microsoft SC 400, SC 100, SC 200, or SC 300, as well as CISSP, CISM, GIAC, or comparable security certifications.

Education

Bachelor's degree in Computer Science, Information Security, Cybersecurity, Information Systems, or a related field, or equivalent professional experience.

Technologies

Microsoft Purview
Microsoft Purview Information Protection
Data Loss Prevention (DLP)
Insider Risk Management
Communication Compliance
Microsoft Copilot
Microsoft Graph API
PowerShell
KQL
Microsoft Sentinel
Microsoft Defender
Entra ID
Azure
Microsoft 365 Security and Compliance ecosystem

Location: Lafayette, LA; Knoxville, TN; Columbia, SC; Birmingham, AL (onsite). Compensation: USD 123,000 - 156,000 per year. Experience: 8+ years.

View full job page →

1mo ago

Senior Cybersecurity Engineer

Teleion Consulting Seattle, WA

Seattle, WA

1mo ago Closed

$155k - $200k/yr Contract Senior Azure Ad / Entra Id Cloud Platforms

This position is no longer accepting applications (closed Oct 19, 2026).

Job Description

Teleion Consulting is hiring a hands-on, client-facing Senior Cybersecurity Engineer to help strengthen cloud security posture and operational readiness for real-world threats. This onsite contract role in Seattle, WA focuses on maturing incident response, advancing data protection, and improving zero trust capabilities across the Microsoft security ecosystem, including Sentinel, Defender, Entra, Intune, and Microsoft Purview.

You will directly support production client environments by configuring and operating Microsoft security tools, leading incident response activities end-to-end, and building durable detection and automation workflows that reduce noise and improve analyst efficiency. The role also includes improving security hygiene in Azure and multi-cloud settings through benchmark remediation and identity and entitlement risk reduction.

Responsibilities

Configure, tune, and operate the Microsoft security stack in production client environments, including Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Lead incident response for real security events such as account compromise, data exfiltration, insider risk, and BEC, covering containment, eradication, recovery, evidence preservation, and post-incident reporting.
Coordinate with MXDR or managed SOC providers on escalation quality, handoff, and case closure standards.
Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel, map detections to MITRE ATT&CK, close coverage gaps, and tune for signal quality and ingestion cost.
Develop SOAR playbooks to reduce false positive volume and automate analyst workflows.
Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps, moving findings to closure rather than alerting only.
Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support.
Harden Azure and multi-cloud environments by remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access, PIM, device compliance, and least-privilege access patterns.
Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation.
Design and run tabletop exercises to test and mature the client’s incident response capability.

Requirements

7+ years of security engineering or security operations experience in enterprise environments.
Production-configured hands-on experience across the full Microsoft security stack: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Demonstrated leadership of real security incidents through the full lifecycle, including containment, eradication, recovery, and post-incident reporting.
Strong KQL proficiency, including analytic rules, hunting queries, tuning for cost and signal quality, and mapping to MITRE ATT&CK.
Direct, demonstrable Microsoft Purview experience across DLP policy design and tuning, sensitivity labels, Insider Risk Management, and eDiscovery.
Experience hardening Azure environments: remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Experience implementing zero trust controls across multiple pillars using Conditional Access and PIM (privileged access management).
PowerShell and Microsoft Graph API proficiency for security automation.
Experience coordinating with MXDR or managed SOC providers on escalation and case quality.
Certifications preferred: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP. Cloud and M365 digital forensics experience is a plus.