M365 Security Compliance Architect

Job Description — M365 Security & Compliance Architect

Role Purpose :

Own the end-to-end implementation, hardening, and governance of Microsoft 365 E5 across Pay10 India, aligning to RBI requirements and relevant local regulations. Establish Zero-Trust controls, identity governance (PIM / PAM), information protection, and audit-ready compliance operations.

Key Responsibilities

Architecture & Rollout

Design the M365 E5 security architecture (Identity, Access, Devices, Data, Threat, Governance).

Implement Entra ID P2 , PIM / PAM , Conditional Access , MFA , SSPR , Break-glass strategy.

Deploy Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps (CASB / MCAS) .

Implement Purview : Information Protection (MIP sensitivity labels), DLP , Records / Retention .

Intune device compliance, baselines, and app protection policies (Windows, macOS, iOS / Android).

Compliance & Audit

Map M365 controls to RBI IT Framework , DPDP Act 2023, ISO 27001, PCI-DSS

Configure Compliance Manager scorecards, assessments, evidence, and audit artifacts.

Define data classification , legal holds, retention schedules, and cross-border data handling.

Operations & Governance

Build SOPs / runbooks : joiner-mover-leaver, incident response, PIM approvals, break-glass drills.

Establish monitoring & reporting (KQL, Power BI, Graph API) for compliance and security posture.

• Conduct KT to internal admins;
• lead CAB / ISMS change processes;

drive continuous improvement.

Stakeholder & Vendor Management

Collaborate with customer’s finalized vendor(s) for network security alignment and integrations.

coordinate with legal / compliance for evidence packs and audits.

Required Experience

4-5+ years hands-on with M365 E5 security & compliance at enterprise scale.

Deep expertise in Entra ID P2 (PIM / PAM) , Conditional Access, Defender suite, Purview (MIP / DLP / eDiscovery), Intune.

Proven delivery in regulated financial services (banks / NBFC / fintech / payments).

Strong understanding of RBI , DPDP 2023 , ISO 27001 , PCI-DSS

Success KPIs

E5 controls implemented & validated (India) within agreed timeline.

Compliance score uplift (Compliance Manager) and successful internal audit sign-off.

zero critical audit non-conformities.

Successful replication to the first GCC region with documented SOPs and KT.