Senior Microsoft Purview Consultant

Business Drivers The initiative aims to: • Enable strategic AI adoption initiatives across the bank through secure information protection controls. • Strengthen prevention of sensitive data leakage to public AI and Large Language Model (LLM) services. • Meet current and emerging regulatory obligations. • Establish a stronger DLP foundation across the organization. • Improve collaboration with investigative and fraud teams, including Internal Fraud SE and Business Banking teams. • Enhance visibility into sensitive data movement and policy violations. • Improve control effectiveness, monitoring, reporting, and investigations. • Establish scalable governance and operational practices for long-term capability growth. ________________________________________ Role Responsibilities

1. DLP Strategy, Assessment & Advisory

• Assess current-state Information Protection and DLP capabilities. • Review existing Microsoft Purview DLP implementations and policies. • Identify capability gaps, inefficiencies, and improvement opportunities. • Provide strategic recommendations and expert guidance on future-state DLP architecture. • Validate implementation approaches against industry best practices and regulatory expectations. • Advise leadership and stakeholders on DLP roadmap, governance, and capability maturity. • Support decision-making related to control effectiveness, scalability, and operational sustainability. ________________________________________

1. Microsoft Purview DLP Design & Implementation

Design, configure, tune, deploy, and optimize Microsoft Purview DLP controls across: Email Protection • Outbound email monitoring and inspection. • Policy enforcement and notification mechanisms. • Sensitive content detection and policy matching. • Approval workflows for restricted communications. • Regulatory and audit reporting. Web Upload Protection • Detection and prevention of sensitive content uploads. • Restriction of uploads to approved destinations. • Monitoring of file transfer and web-based data movement. • Management of trusted and restricted websites. Endpoint DLP • Monitoring and protection of sensitive information on endpoints. • User activity tracking and evidence collection. • Prevention of data exfiltration activities. AI Data Protection Controls • Preventing sensitive content from being pasted into non-approved AI tools. • Blocking uploads of protected information to public Large Language Models. • Restricting highly sensitive documents from approved internal AI platforms when required. • Supporting secure enterprise AI adoption through effective DLP guardrails. ________________________________________

1. Priority Use Case Delivery

Use Case 1: AI Data Leakage Prevention Design and implement controls that prevent sensitive information from being: • Uploaded to public AI platforms. • Shared with non-approved AI services. • Copied or pasted into Generative AI applications. • Exposed through unauthorized AI interactions. Objectives • Enable strategic AI initiatives within the bank. • Strengthen controls around public LLM usage. • Support secure rollout of future AI capabilities. Deliverables • Production-ready DLP controls. • Control tuning and optimization. • KPI dashboards. • User behavior reporting. • Governance documentation. • Operational procedures. ________________________________________ Use Case 2: New York Branch Regulatory Controls Design and implement enhanced controls for: • Outbound email traffic. • Web upload traffic. • Monitoring of all email communications. • Manager approval workflows for highly sensitive information. Key Drivers • Compliance with specific Federal Reserve (FED) requirements. • Enhanced oversight of sensitive information handling. • Detailed evidence collection and reporting. Deliverables • Regulatory-aligned DLP controls. • Approval processes and workflows. • Comprehensive audit trails. • Detailed compliance reporting. • Investigation support capabilities. ________________________________________ Use Case 3: Enterprise Sensitive Content Monitoring Implement standardized monitoring capabilities across all supported communication and data channels. Objectives • Detect sensitive information movement across the organization. • Improve transparency into data leakage activity. • Enable evidence collection and investigation support. • Facilitate escalation to investigative teams. • Establish foundations for future targeted DLP use cases. Deliverables • Enterprise monitoring framework. • Escalation procedures. • Investigation support processes. • DLP visibility dashboards. • Leakage trend reporting. ________________________________________ Governance & Framework Development Responsibilities The consultants will be expected to design, validate, document, and implement supporting governance frameworks and operational practices. Sensitive Information Type (SIT) Framework Establish standards covering: • SIT selection methodology. • Confidence level definitions. • Instance count thresholds. • Effectiveness measurements. • Detection tuning methodologies. • Custom Swedbank-specific SIT development. • Testing and validation procedures. Examples include: • Credit Card Numbers • IBAN Detection • Customer Data • Financial Information • Regulatory Information • Internal Sensitive Data Categories ________________________________________ Whitelisting Framework Define and document: • Standardized whitelisting processes. • Internal trusted domains. • Approved external partners. • Grey-list management for AI services. • Exception approval procedures. • Ownership and maintenance models. • Stakeholder-managed whitelist processes. ________________________________________ KPI Dashboard & Reporting Standards Design and implement: Microsoft Sentinel Reporting • Sentinel Workbooks. • KPI dashboards. • Control effectiveness reporting. • Trend analysis. • User behavior analytics. • Executive reporting dashboards. Reporting Architecture • Aggregated data layers. • Secure reporting access model. • Log Analytics integration. • Automated reporting capabilities. • Stakeholder-specific reporting views. ________________________________________ Investigation & Audit Reporting Framework Develop standard patterns and procedures for: • Intercepted email reporting. • Investigation support reporting. • Audit evidence requests. • Regulatory reporting requirements. • Data leakage analysis. • Incident trend reporting. ________________________________________ Content Capture & Evidence Handling Define standard processes for: • Content capture. • Evidence retention. • Investigation support. • Data handling requirements. • Secure evidence storage and retrieval. ________________________________________ Avoidance Detection Practices Establish standard methods to: • Detect DLP circumvention attempts. • Identify scanning failures. • Monitor avoidance techniques. • Escalate suspicious activities. • Improve long-term control effectiveness. ________________________________________ Required Technical Expertise Microsoft Technologies • Microsoft Purview Data Loss Prevention • Microsoft Purview Information Protection • Microsoft Purview Compliance Portal • Microsoft Sentinel • Microsoft Defender Suite • Microsoft Entra ID • Microsoft 365 Security & Compliance • Log Analytics Workspace • Kusto Query Language (KQL) ________________________________________ Core Domain Expertise • Enterprise Data Loss Prevention • Information Protection • Data Classification • Sensitive Information Types (SITs) • Security Governance • Compliance Management • Security Monitoring & Reporting • Audit & Regulatory Controls • AI Security & Information Protection • Control Design & Optimization ________________________________________ Experience Requirements Mandatory • Minimum 10+ years of overall experience in Cybersecurity, Information Security, Data Protection, Information Governance, or related security disciplines. • Minimum 7+ years of hands-on experience designing, implementing, and managing enterprise-scale Data Loss Prevention (DLP) programs. • Minimum 5+ years of advanced Microsoft Purview DLP and Information Protection experience. • Extensive experience configuring, tuning, and optimizing DLP controls across email, endpoints, web traffic, cloud services, and collaboration platforms. • Proven experience delivering enterprise Information Protection and DLP transformation initiatives. • Strong experience designing governance frameworks, policies, standards, and control operating models. • Experience establishing Sensitive Information Type (SIT) frameworks and classification standards. • Experience developing executive dashboards, KPI reporting, and operational reporting frameworks. • Demonstrated ability to assess current-state capabilities and define future-state roadmaps. • Strong stakeholder management and advisory experience with senior leadership, security teams, compliance teams, and business representatives. ________________________________________ Preferred • Banking or financial services experience. • Experience supporting compliance with financial sector regulatory requirements. • Experience implementing controls related to AI platforms and Large Language Models (LLMs). • Experience building Microsoft Sentinel Workbooks and advanced reporting solutions. • Experience supporting fraud investigation and security operations teams. • Experience operating within large, multinational organizations. ________________________________________ Preferred Certifications • Microsoft Certified: Information Protection and Compliance Administrator (SC-400) • Microsoft Certified: Security Operations Analyst (SC-200) • Microsoft Certified: Cybersecurity Architect Expert (SC-100) • CISSP • CISM • CRISC • ISO 27001 Lead Implementer or Lead Auditor ________________________________________ Key Deliverables The engagement is expected to deliver: Operational Deliverables • Implementation of all three prioritized use cases. • Configured and optimized DLP controls. • Production-ready Microsoft Sentinel dashboards. • Reporting and monitoring framework. • Governance documentation. • Standard operating procedures. Governance Deliverables • SIT governance framework. • Whitelisting framework. • Reporting standards. • Content handling standards. • Avoidance detection procedures. • Operational governance model. Strategic Deliverables • Current-state assessment. • Gap analysis. • Future-state architecture recommendations. • DLP maturity roadmap. • Capability enhancement recommendations. Final Engagement Report A comprehensive end-of-engagement assessment including: • Current-state capability review. • Effectiveness assessment of implemented controls. • Governance maturity evaluation. • Risk and gap analysis. • Recommendations for future investments and enhancements. • Prioritized roadmap for continued Information Protection transformation.