Senior Security Engineer (Microsoft Purview +Zscaler)

About the role

Senior Security Engineer - focused on Zscaler and Microsoft Purview CONTRACT - 6 Months, with ongoing extension Remote - preference to candidates in Raleigh, NC We are seeking a senior hands-on security engineer to design, operate, and improve enterprise security controls across Zscaler ZIA, ZPA, and ZDX and Microsoft Purview Information Protection and Data Loss Prevention. This role partners with network, identity, endpoint, cloud, data governance, risk, and security operations teams to strengthen Zero Trust access, protect sensitive information, reduce user disruption, and improve monitoring and response.

Responsibilities

• Administer and optimize ZIA controls, traffic forwarding, TLS inspection, cloud firewall, DNS security, URL filtering, threat prevention, CASB, and data protection.
• Engineer and maintain ZPA App Connectors, application segments, segment groups, access policies, posture profiles, and identity-based access.
• Use ZDX or comparable digital experience telemetry to isolate endpoint, network, application, and service-path issues.
• Implement and tune Purview sensitivity labels, auto-labeling, Endpoint DLP, and DLP policies across Exchange, SharePoint, OneDrive, Teams, endpoints, and supported cloud applications.
• Execute controlled production changes, investigate security and user-experience events, perform root cause analysis, and reduce false positives and recurring incidents.
• Integrate platform telemetry with SIEM, SOAR, identity, endpoint, and ticketing tools and automate administration, validation, reporting, and evidence collection.

Qualifications

• Eight or more years of hands-on experience in security, network, cloud, data, or Microsoft 365 engineering, or equivalent depth.
• Recent production administration of Zscaler ZIA and ZPA in a complex enterprise environment.
• Hands-on Microsoft Purview Information Protection and DLP experience, including sensitivity labels, policy testing, alerts, exceptions, and endpoint or Microsoft 365 enforcement.
• Strong networking knowledge across TCP/IP, HTTP/S, DNS, proxies, firewalls, TLS inspection, PAC files, tunnels, and traffic-forwarding methods.
• Experience with Microsoft 365, Entra ID, authentication and provisioning, Conditional Access, Intune, or device posture.
• Experience with SIEM or SOAR integration and PowerShell, Python, REST APIs, or comparable automation.
• Strong troubleshooting, documentation, communication, and cross-functional delivery skills.