Senior Microsoft Purview

Role Title: Senior Microsoft Purview DLP Consultant / Information Protection Specialist Location: Sundbyberg, Sweden (Hybrid) Duration: 3-Month Contract Position Overview client is undertaking a strategic redesign of its Information Protection capability, including a comprehensive re-take of its Data Loss Prevention (DLP) controls and supporting governance framework. This initiative is driven by regulatory requirements, enterprise security objectives, and the need to securely enable strategic Artificial Intelligence (AI) initiatives across the bank. To accelerate delivery, client seeks up to two highly experienced Senior Microsoft Purview DLP Consultants who can augment the existing Information Protection team and provide strategic advisory, technical implementation, governance design, and operational support. The selected consultants will be responsible for designing, implementing, tuning, governing, and operationalizing Microsoft Purview DLP capabilities while establishing sustainable frameworks, reporting capabilities, and best practices that support long-term Information Protection maturity. The engagement will focus on delivering three high-priority use cases while simultaneously improving supporting frameworks, governance processes, reporting mechanisms, and operational standards. Business Drivers The initiative aims to:

• Enable strategic AI adoption initiatives across the bank through secure information protection controls.
• Strengthen prevention of sensitive data leakage to public AI and Large Language Model (LLM) services.
• Meet current and emerging regulatory obligations.
• Establish a stronger DLP foundation across the organization.
• Improve collaboration with investigative and fraud teams, including Internal Fraud SE and Business Banking teams.
• Enhance visibility into sensitive data movement and policy violations.
• Improve control effectiveness, monitoring, reporting, and investigations.
• Establish scalable governance and operational practices for long-term capability growth.

Role Responsibilities

1. DLP Strategy, Assessment & Advisory

• Assess current-state Information Protection and DLP capabilities.
• Review existing Microsoft Purview DLP implementations and policies.
• Identify capability gaps, inefficiencies, and improvement opportunities.
• Provide strategic recommendations and expert guidance on future-state DLP architecture.
• Validate implementation approaches against industry best practices and regulatory expectations.
• Advise leadership and stakeholders on DLP roadmap, governance, and capability maturity.
• Support decision-making related to control effectiveness, scalability, and operational sustainability.

1. Microsoft Purview DLP Design & Implementation

Design, configure, tune, deploy, and optimize Microsoft Purview DLP controls across: Email Protection

• Outbound email monitoring and inspection.
• Policy enforcement and notification mechanisms.
• Sensitive content detection and policy matching.
• Approval workflows for restricted communications.
• Regulatory and audit reporting.

Web Upload Protection

• Detection and prevention of sensitive content uploads.
• Restriction of uploads to approved destinations.
• Monitoring of file transfer and web-based data movement.
• Management of trusted and restricted websites.

Endpoint DLP

• Monitoring and protection of sensitive information on endpoints.
• User activity tracking and evidence collection.
• Prevention of data exfiltration activities.

AI Data Protection Controls

• Preventing sensitive content from being pasted into non-approved AI tools.
• Blocking uploads of protected information to public Large Language Models.
• Restricting highly sensitive documents from approved internal AI platforms when required.
• Supporting secure enterprise AI adoption through effective DLP guardrails.

1. Priority Use Case Delivery

Use Case 1: AI Data Leakage Prevention Design and implement controls that prevent sensitive information from being:

• Uploaded to public AI platforms.
• Shared with non-approved AI services.
• Copied or pasted into Generative AI applications.
• Exposed through unauthorized AI interactions.

Objectives

• Enable strategic AI initiatives within the bank.
• Strengthen controls around public LLM usage.
• Support secure rollout of future AI capabilities.

Deliverables

• Production-ready DLP controls.
• Control tuning and optimization.
• KPI dashboards.
• User behavior reporting.
• Governance documentation.
• Operational procedures.

Use Case 2: New York Branch Regulatory Controls Design and implement enhanced controls for:

• Outbound email traffic.
• Web upload traffic.
• Monitoring of all email communications.
• Manager approval workflows for highly sensitive information.

Key Drivers

• Compliance with specific Federal Reserve (FED) requirements.
• Enhanced oversight of sensitive information handling.
• Detailed evidence collection and reporting.

Deliverables

• Regulatory-aligned DLP controls.
• Approval processes and workflows.
• Comprehensive audit trails.
• Detailed compliance reporting.
• Investigation support capabilities.

Use Case 3: Enterprise Sensitive Content Monitoring Implement standardized monitoring capabilities across all supported communication and data channels. Objectives

• Detect sensitive information movement across the organization.
• Improve transparency into data leakage activity.
• Enable evidence collection and investigation support.
• Facilitate escalation to investigative teams.
• Establish foundations for future targeted DLP use cases.

Deliverables

• Enterprise monitoring framework.
• Escalation procedures.
• Investigation support processes.
• DLP visibility dashboards.
• Leakage trend reporting.

Governance & Framework Development Responsibilities The consultants will be expected to design, validate, document, and implement supporting governance frameworks and operational practices. Sensitive Information Type (SIT) Framework Establish standards covering:

• SIT selection methodology.
• Confidence level definitions.
• Instance count thresholds.
• Effectiveness measurements.
• Detection tuning methodologies.
• Custom Swedbank-specific SIT development.
• Testing and validation procedures.

Examples include:

• Credit Card Numbers
• IBAN Detection
• Customer Data
• Financial Information
• Regulatory Information
• Internal Sensitive Data Categories

Whitelisting Framework Define and document:

• Standardized whitelisting processes.
• Internal trusted domains.
• Approved external partners.
• Grey-list management for AI services.
• Exception approval procedures.
• Ownership and maintenance models.
• Stakeholder-managed whitelist processes.

KPI Dashboard & Reporting Standards Design and implement: Microsoft Sentinel Reporting

• Sentinel Workbooks.
• KPI dashboards.
• Control effectiveness reporting.
• Trend analysis.
• User behavior analytics.
• Executive reporting dashboards.

Reporting Architecture

• Aggregated data layers.
• Secure reporting access model.
• Log Analytics integration.
• Automated reporting capabilities.
• Stakeholder-specific reporting views.

Investigation & Audit Reporting Framework Develop standard patterns and procedures for:

• Intercepted email reporting.
• Investigation support reporting.
• Audit evidence requests.
• Regulatory reporting requirements.
• Data leakage analysis.
• Incident trend reporting.

Content Capture & Evidence Handling Define standard processes for:

• Content capture.
• Evidence retention.
• Investigation support.
• Data handling requirements.
• Secure evidence storage and retrieval.

Avoidance Detection Practices Establish standard methods to:

• Detect DLP circumvention attempts.
• Identify scanning failures.
• Monitor avoidance techniques.
• Escalate suspicious activities.
• Improve long-term control effectiveness.

Required Technical Expertise Microsoft Technologies

• Microsoft Purview Data Loss Prevention
• Microsoft Purview Information Protection
• Microsoft Purview Compliance Portal
• Microsoft Sentinel
• Microsoft Defender Suite
• Microsoft Entra ID
• Microsoft 365 Security & Compliance
• Log Analytics Workspace
• Kusto Query Language (KQL)

Core Domain Expertise

• Enterprise Data Loss Prevention
• Information Protection
• Data Classification
• Sensitive Information Types (SITs)
• Security Governance
• Compliance Management
• Security Monitoring & Reporting
• Audit & Regulatory Controls
• AI Security & Information Protection
• Control Design & Optimization

Experience Requirements Mandatory

• Minimum 10+ years of overall experience in Cybersecurity, Information Security, Data Protection, Information Governance, or related security disciplines.
• Minimum 7+ years of hands-on experience designing, implementing, and managing enterprise-scale Data Loss Prevention (DLP) programs.
• Minimum 5+ years of advanced Microsoft Purview DLP and Information Protection experience.
• Extensive experience configuring, tuning, and optimizing DLP controls across email, endpoints, web traffic, cloud services, and collaboration platforms.
• Proven experience delivering enterprise Information Protection and DLP transformation initiatives.
• Strong experience designing governance frameworks, policies, standards, and control operating models.
• Experience establishing Sensitive Information Type (SIT) frameworks and classification standards.
• Experience developing executive dashboards, KPI reporting, and operational reporting frameworks.
• Demonstrated ability to assess current-state capabilities and define future-state roadmaps.
• Strong stakeholder management and advisory experience with senior leadership, security teams, compliance teams, and business representatives.

Preferred

• Banking or financial services experience.
• Experience supporting compliance with financial sector regulatory requirements.
• Experience implementing controls related to AI platforms and Large Language Models (LLMs).
• Experience building Microsoft Sentinel Workbooks and advanced reporting solutions.
• Experience supporting fraud investigation and security operations teams.
• Experience operating within large, multinational organizations.

Preferred Certifications

• Microsoft Certified: Information Protection and Compliance Administrator (SC-400)
• Microsoft Certified: Security Operations Analyst (SC-200)
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• CISSP
• CISM
• CRISC
• ISO 27001 Lead Implementer or Lead Auditor