Microsoft Purview and DLP Engineer L3

VaporVM; Dubai; On-site; AED 260,000 - 420,000; Full time

Job summary

VaporVM is seeking an experienced Microsoft Purview and DLP Engineer L3 to provide advanced administration, engineering, monitoring, and investigation support across enterprise data protection platforms.

The ideal candidate will have strong hands-on expertise in Microsoft Purview, DLP, IRM, and security operations, with experience integrating data protection solutions with SIEM, SOAR, and data governance platforms.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Electronics Engineering, or related field.
• 5–6 years of cybersecurity experience with hands-on Purview, DLP, and IRM.
• Strong knowledge of Microsoft 365 security, data classification, sensitivity labels, encryption, and DLP.
• Proficiency in KQL and PowerShell for querying, automation, and investigations.
• Experience integrating Purview, DLP, and IRM with IBM QRadar SIEM and SOAR platforms.
• Familiarity with RBAC, change management, and secure evidence handling.

Responsibilities

• Administer, configure, maintain Purview including DLP and IRM.
• Implement data protection controls across Microsoft 365 and endpoints.
• Identify coverage gaps and test policies to reduce false positives.
• Develop KQL detections for threat hunting and reporting.
• Integrate Purview, DLP, IRM with SIEM and SOAR platforms.
• Develop automated investigation and response workflows using Security Copilot.
• Monitor alerts, conduct L3 investigations, and coordinate remediation.
• Collaborate with cross-functional teams; maintain runbooks and evidence.
• Prepare weekly progress updates and monthly security reports.

Skills

KQL queries

Threat hunting

Investigation

Collaboration

Education

Bachelor's degree in CS/IT/Engineering

Tools

IBM QRadar SIEM

SOAR platforms

Microsoft Purview

PowerShell

Job description

We are seeking an experienced Microsoft Purview and DLP Engineer L3 to provide advanced administration, engineering, monitoring, and investigation support across enterprise data protection platforms. The ideal candidate will have strong hands‑on expertise in Microsoft Purview, Data Loss Prevention (DLP), Insider Risk Management (IRM), and security operations, with experience integrating data protection solutions with SIEM, SOAR, and data governance platforms.

Key Responsibilities

• Administer, configure, maintain, and troubleshoot Microsoft Purview, including sensitivity labels, data classification, encryption, DLP policies, and Insider Risk Management.
• Implement and optimize data protection controls across Microsoft 365 environments and supported endpoints.
• Identify control coverage gaps, conduct policy testing, reduce false positives, and implement approved policy enhancements.
• Develop and maintain KQL queries and detection use cases for threat hunting, monitoring, and reporting.
• Integrate Microsoft Purview, DLP, and IRM with SIEM and SOAR platforms, including IBM QRadar.
• Develop automated investigation and response workflows using Microsoft Security Copilot.
• Monitor security alerts, conduct L3-level investigations, handle MSSP escalations, and coordinate remediation activities.
• Collaborate with endpoint, identity, messaging, application, infrastructure, data governance, and compliance teams.
• Maintain operational runbooks, audit evidence, configuration records, risk registers, and exception documentation.
• Prepare weekly progress updates and monthly reports covering security incidents, control coverage, compliance, and remediation activities.

Required Skills & Qualifications

• Bachelor's degree in Computer Science, Information Technology, Electronics Engineering, or a related discipline.
• 5–6 years of relevant cybersecurity experience, with strong hands‑on expertise in Microsoft Purview, DLP, and Insider Risk Management.
• Strong knowledge of Microsoft 365 security, data classification, sensitivity labels, encryption, and endpoint/cloud DLP.
• Proficiency in KQL and PowerShell for querying, automation, troubleshooting, and security investigations.
• Hands‑on experience integrating Microsoft Purview, DLP, and IRM with:
• IBM QRadar SIEM
• SOAR platforms
• Understanding of alert forwarding, security use‑case onboarding, automated response workflows, and investigation processes.
• Knowledge of role‑based access control (RBAC), least privilege, change management, and secure evidence handling.
• Strong troubleshooting, analytical, documentation, and stakeholder coordination skills.

Preferred Certifications

• Microsoft Certified: Information Security Administrator Associate (SC-401) – Preferred.
• Microsoft Certified: Security Operations Analyst Associate (SC-200) – Advantageous.