Principal Data & AI Security Engineer - Purview & AI Governance

About Onit We're redefining the future of legal operations through the power of AI. Our cutting-edge platform streamlines enterprise legal management, matter management, spend management and contract lifecycle processes, transforming manual workflows into intelligent, automated solutions. We’re a team of innovators using AI at the core to help legal departments become faster, smarter, and more strategic. As we continue to grow and expand the capabilities of our new AI-centric platform, we’re looking for bold thinkers and builders who are excited to shape the next chapter of legal tech. If you're energized by meaningful work, love solving complex problems, and want to help modernize how legal teams operate, we’d love to meet you. Position Summary This is a hands-on technical role focused on Microsoft Purview, data protection and the rapidly evolving security/governance requirements created by enterprise AI adoption. The role will provide deep technical ownership of information protection, DLP, retention, eDiscovery/legal hold and Microsoft 365 data security, while building broader capability in AI security, Shadow AI, data exposure/oversharing and AI governance. We are not looking for a candidate who already knows every AI governance technology; we are looking for strong Purview/data-security depth combined with demonstrated learnability and the ability to expand into emerging AI security and governance areas. Onit's technology environment changes quickly. The successful candidate will be evaluated not only on what they already know, but on how effectively they learn, apply and operationalize new capabilities. What This Role Is Expected to Deliver • Build and mature Onit's Microsoft Purview information protection and DLP capabilities across Microsoft 365 and endpoints. • Improve protection of sensitive data across SharePoint, OneDrive, Teams and endpoints, including labeling, access/oversharing risk and data lifecycle controls. • Make the Microsoft 365 data estate safer for generative AI and other approved AI tools and use cases by understanding what AI can access and where sensitive data may be exposed. • Translate emerging AI/data-governance requirements into practical technical controls, operating processes and measurable improvements. • Implement and operationalize any CASB, SSPM, DSPM and Shadow AI discovery/governance solutions to identify risk, enforce controls, remediate exposure and improve SaaS/AI security posture. Key Responsibilities • Design, implement, tune and operate Microsoft Purview Data Loss Prevention (DLP), including Microsoft 365 and Endpoint DLP scenarios. • Own Microsoft Purview Information Protection capabilities including sensitivity labels, publishing policies, auto-labeling, Sensitive Information Types (SITs), trainable/classification concepts and policy tuning. • Implement and support retention, records/data lifecycle, legal hold, Content Search, Core/Advanced eDiscovery workflows, audit and evidence-preservation processes where required. • Partner with business, legal, privacy, security and IT stakeholders to translate data-protection requirements into workable Purview policies without creating excessive user friction or false positives. • Assess and improve sensitive-data exposure across SharePoint, OneDrive and Teams, including oversharing, external sharing, broad group access and inherited/direct permissions in collaboration with M365 platform owners. • Support data-security readiness for Microsoft Copilot, Claude, Anthropic, Cursor and other enterprise AI tools by identifying sensitive content exposure, access pathways and control gaps before broader AI enablement. • Develop capability in AI data security and governance areas such as DSPM for AI, Shadow AI discovery, sanctioned/unsanctioned AI use, prompt/data leakage risk, AI application inventory and policy/control mapping. • Work with CASB/SSE/SASE or SaaS discovery capabilities where they contribute to identifying Shadow AI/Shadow IT and controlling risky data movement; deep SAM/licensing expertise is not a requirement for this role. • Use PowerShell, Microsoft Graph and Microsoft 365 reporting capabilities to automate policy validation, reporting, investigation support and recurring operational tasks. • Own complex L3 troubleshooting for Purview/DLP policy behavior, classification, labeling, endpoint DLP, eDiscovery/legal-hold and Microsoft 365 data-protection issues. • Evaluate new Microsoft Purview, Copilot security and AI-governance capabilities through structured lab/POV testing and recommend production adoption based on risk reduction and operational value. • Create technical designs, SOPs, runbooks and decision records; mentor IT team members and transfer data-security knowledge across the team. • Lead data-security and AI-governance projects from requirements and pilot through rollout, change communication, validation and steady-state handover. Required Skills - Must Have • Strong hands-on Microsoft Purview experience in an enterprise Microsoft 365 environment. • Hands-on DLP experience, including policy design/tuning and practical understanding of false positives, exceptions and business impact. • Strong Information Protection experience: sensitivity labels, publishing, auto-labeling and classification/Sensitive Information Type concepts. • Hands-on experience with retention, legal hold/eDiscovery, audit or related Microsoft Purview data lifecycle/investigation capabilities. • Microsoft Purview DSPM / Data Security Posture Management and AI data-security capabilities. • CASB/SSE/SASE, Shadow IT or Shadow AI discovery/control concepts. • Strong understanding of SharePoint, OneDrive and Teams as data repositories and how permissions/sharing affect data security. • Working Microsoft Entra ID knowledge sufficient to understand identity, group membership and access dependencies that affect data protection. • Strong L3 troubleshooting and analytical skills across Purvie