Copilot Security & Governance Expert (GCC)

Potomac Haven; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Job summary

Potomac Haven seeks a Copilot SME to assess how Microsoft 365 Copilot on GCC accesses and processes organizational data, identifies security and governance risks, and ensures only authorized information surfaces to end users.

The role reviews Copilot's extensibility surface—agents, plugins, Graph connectors, and web grounding—and partners with identity and compliance SMEs to align findings with Zero Trust and DLP controls. Strong communication skills are essential.

Qualifications

• 3+ years of hands-on experience with Microsoft 365 Copilot deployment on GCC, governance, or security assessment.
• Working knowledge of Microsoft Graph and how it underlies Copilot's data access model.
• Practical experience with Copilot extensibility: agents, plugins, Copilot Studio, and Graph connectors.
• Familiarity with Microsoft Entra ID, Conditional Access, and Purview (DLP, sensitivity labels, DSPM for AI) as they relate to Copilot.
• Understanding of Zero Trust principles as applied to AI/Copilot environments.
• Experience with Microsoft 365 Government Community Cloud (GCC) a plus, including awareness of feature-parity gaps versus commercial tenants.
• Strong written communication skills; able to translate technical findings for both administrators and executives.

Responsibilities

• Assess how Copilot retrieves and summarizes content through Microsoft Graph, and identify where existing permissions could create unintended data exposure once Copilot is enabled.
• Review Copilot tenant controls, including web search/web grounding behavior, AI DISCLAIMERS, responsible AI protections, and preview or in-development features.
• Evaluate agent, plugin, and Graph connector governance — including who can create, install, approve, publish, and use them — to prevent unapproved extensions from expanding Copilot's access to sensitive content.
• Identify third-party integrations and connectors that could broaden Copilot's reach beyond intended data boundaries.
• Partner with identity, data governance, and compliance SMEs to validate that Copilot findings align with broader Zero Trust, DLP, and sensitivity-labeling controls.
• Document findings in plain, business-readable language, with risk ratings and prioritized, actionable recommendations.
• Support controlled, non-destructive validation testing of Copilot behavior using approved test accounts and synthetic data.
• Stay current on Microsoft's evolving Copilot governance guidance (Microsoft Learn, Zero Trust for Copilot, Purview DSPM for AI) and translate updates into assessment practice.

Skills

Microsoft 365 Copilot deployment

Governance & security assessment

Microsoft Graph data access model

Copilot extensibility (agents, plugins

Zero Trust for AI/Copilot

Written communication

Tools

Graph connectors

Copilot Studio

Microsoft Entra ID

Conditional Access

Purview (DLP, sensitivity labels)

DSPM for AI

Job description

Potomac Haven seeks a Copilot SME to assess how Microsoft 365 Copilot on GCC accesses and processes organizational data, identifies security and governance risks, and ensures only authorized information surfaces to end users.

The role reviews Copilot's extensibility surface—agents, plugins, Graph connectors, and web grounding—and partners with identity and compliance SMEs to align findings with Zero Trust and DLP controls. Strong communication skills are essential.