Principal Data & AI Security Engineer - Purview & AI Governance

About Onit We're redefining the future of legal operations through the power of AI. Our cutting-edge platform streamlines enterprise legal management, matter management, spend management and contract lifecycle processes, transforming manual workflows into intelligent, automated solutions. We’re a team of innovators using AI at the core to help legal departments become faster, smarter, and more strategic. As we continue to grow and expand the capabilities of our new AI-centric platform, we’re looking for bold thinkers and builders who are excited to shape the next chapter of legal tech. If you're energized by meaningful work, love solving complex problems, and want to help modernize how legal teams operate, we’d love to meet you. Position Summary This is a hands-on technical role focused on Microsoft Purview, data protection and the rapidly evolving security/governance requirements created by enterprise AI adoption. The role will provide deep technical ownership of information protection, DLP, retention, eDiscovery/legal hold and Microsoft 365 data security, while building broader capability in AI security, Shadow AI, data exposure/oversharing and AI governance. We are not looking for a candidate who already knows every AI governance technology; we are looking for strong Purview/data-security depth combined with demonstrated learnability and the ability to expand into emerging AI security and governance areas. Onit's technology environment changes quickly. The successful candidate will be evaluated not only on what they already know, but on how effectively they learn, apply and operationalize new capabilities. What This Role Is Expected to Deliver

Build and mature Onit's Microsoft Purview information protection and DLP capabilities across Microsoft 365 and endpoints.

Improve protection of sensitive data across SharePoint, OneDrive, Teams and endpoints, including labeling, access/oversharing risk and data lifecycle controls.

Make the Microsoft 365 data estate safer for generative AI and other approved AI tools and use cases by understanding what AI can access and where sensitive data may be exposed.

Translate emerging AI/data-governance requirements into practical technical controls, operating processes and measurable improvements.

Implement and operationalize any CASB, SSPM, DSPM and Shadow AI discovery/governance solutions to identify risk, enforce controls, remediate exposure and improve SaaS/AI security posture.

Key Responsibilities

Design, implement, tune and operate Microsoft Purview Data Loss Prevention (DLP), including Microsoft 365 and Endpoint DLP scenarios.

Own Microsoft Purview Information Protection capabilities including sensitivity labels, publishing policies, auto-labeling, Sensitive Information Types (SITs), trainable/classification concepts and policy tuning.

Implement and support retention, records/data lifecycle, legal hold, Content Search, Core/Advanced eDiscovery workflows, audit and evidence-preservation processes where required.

Partner with business, legal, privacy, security and IT stakeholders to translate data-protection requirements into workable Purview policies without creating excessive user friction or false positives.

Assess and improve sensitive-data exposure across SharePoint, OneDrive and Teams, including oversharing, external sharing, broad group access and inherited/direct permissions in collaboration with M365 platform owners.

Support data-security readiness for Microsoft Copilot, Claude, Anthropic, Cursor and other enterprise AI tools by identifying sensitive content exposure, access pathways and control gaps before broader AI enablement.

Develop capability in AI data security and governance areas such as DSPM for AI, Shadow AI discovery, sanctioned/unsanctioned AI use, prompt/data leakage risk, AI application inventory and policy/control mapping.

Work with CASB/SSE/SASE or SaaS discovery capabilities where they contribute to identifying Shadow AI/Shadow IT and controlling risky data movement; deep SAM/licensing expertise is not a requirement for this role.

Use PowerShell, Microsoft Graph and Microsoft 365 reporting capabilities to automate policy validation, reporting, investigation support and recurring operational tasks.

Own complex L3 troubleshooting for Purview/DLP policy behavior, classification, labeling, endpoint DLP, eDiscovery/legal-hold and Microsoft 365 data-protection issues.

Evaluate new Microsoft Purview, Copilot security and AI-governance capabilities through structured lab/POV testing and recommend production adoption based on risk reduction and operational value.

Create technical designs, SOPs, runbooks and decision records; mentor IT team members and transfer data-security knowledge across the team.

Lead data-security and AI-governance projects from requirements and pilot through rollout, change communication, validation and steady-state handover.

Required Skills - Must Have

Strong hands-on Microsoft Purview experience in an enterprise Microsoft 365 environment.

Hands-on DLP experience, including policy design/tuning and practical understanding of false positives, exceptions and business impact.

Strong Information Protection experience: sensitivity labels, publishing, auto-labeling and classification/Sensitive Information Type concepts.

Hands-on experience with retention, legal hold/eDiscovery, audit or related Microsoft Purview data lifecycle/investigation capabilities.

Microsoft Purview DSPM / Data Security Posture Management and AI data-security capabilities.

CASB/SSE/SASE, Shadow IT or Shadow AI discovery/control concepts.

Strong understanding of SharePoint, OneDrive and Teams as data repositories and how permissions/sharing affect data security.

Working Microsoft Entra ID knowledge sufficient to understand identity, group membership and access dependencies that affect data protection.

Strong L3 troubleshooting and analytical skills across Purview, Microsoft 365 and data-security controls.

Ability to independently plan and execute technical projects/changes, including requirements, pilot, stakeholder communication, risk management, validation and documentation.

Strong written and verbal communication, particularly the ability to explain data-security controls to technical and non-technical stakeholders.

Adjacent Skills - Good to Have / Learn Quickly

Leading AI Tools security/readiness, generative-AI data exposure assessment or AI application governance.

AI governance frameworks such as ISO/IEC 42001, NIST AI RMF, Responsible AI principles or similar governance models.

PowerShell and Microsoft Graph automation for Microsoft 365/Purview operations.

Privacy/regulatory environments such as GDPR and ISO 27001; exposure to legal/compliance workflows is useful.

SaaS discovery, SSPM or SAM concepts are useful adjacent knowledge.

Demonstrates learnability: can move from an unfamiliar security/governance requirement to research, lab/POV, production design, implementation, documentation and knowledge transfer.

Shows evidence of expanding beyond one Microsoft Purview feature into broader data-security, cloud-security or AI-security responsibilities.

What Success Looks Like

Takes technical ownership of all Data security, AI Governance, Purview DLP, labels and data lifecycle/eDiscovery capabilities and reduces dependency on external expertise.

Improves the organization's visibility and control of sensitive data across Microsoft 365 and endpoints.

Builds practical AI data-security capability around Copilot/GenAI readiness, Shadow AI and sensitive-data exposure rather than remaining a traditional DLP-only specialist.

Turns new data-security and AI-governance requirements into implemented, documented and supportable controls.

Experience & Qualifications

12+ years relevant experience across enterprise IT, Microsoft 365, endpoint/security or related infrastructure disciplines.

Demonstrated experience owning production systems and resolving complex technical problems, not only following predefined operational procedures.

Experience working with distributed/global stakeholders and managing technical changes across business teams is preferred.

Bachelor's degree or equivalent practical experience in Information Technology, Computer Science or a related discipline.

Preferred Certifications

Microsoft Certified: Information Security Administrator Associate (SC-401) - strongly preferred

Microsoft Purview / information protection / compliance certification experience (SC-400 legacy or equivalent) - advantage

Microsoft 365 Administrator / MS-102 - advantage

Benefits & Perks That Support You: Onit offers a comprehensive total rewards package designed to support the whole employee at work and beyond: Health Coverage: Employee and immediate family members. Time Away: Flexible paid time off and 10 company paid holidays annually. Family Support: Exceptional paid leave for birth parents, non-birth parents, and caregivers.  Onit also offers surrogacy and adoption reimbursement. Income Protection: 100% employer-paid life and disability insurance. Additional Coverage Options: Voluntary benefits including hospital indemnity, critical illness, accident. Tax-Advantaged Accounts: Flexi, NPS. Community Engagement: One paid volunteer day each year to give back to the community. Our Commitment to Applicants We know that not everyone will check every box in a job description. At Onit, we value diversity, inclusion, and authenticity. If you’re excited about this role but your experience doesn’t align perfectly with every qualification, we encourage you to apply. You may be exactly who we’re looking for. Onit Values  Customer First - Customer success is our success. We deliver value, listen, and act on customer needs.  Purposeful Innovation - Innovation fuels our growth. We harness creativity to solve problems and lead with the intentions and expertise.  Win as One - Teamwork is how we win. We are accountable, act with integrity, and communicate openly.  Intentional Growth - Our people are the difference. We create an environment with compelling work, impactful contributions, and career growth.