Consultancy: Information Protection & Compliance Consultant, ICTD Information Security Section (12 months, remote)

UNICEF works in over 190 countries and territories to save children’s lives, defend their rights, and help them fulfill their potential, from early childhood through adolescence.

At UNICEF, we are committed, passionate, and proud of what we do for as long as we are needed. Promoting the rights of every child is not just a job – it is a calling.

UNICEF is a place where careers are built. We offer our staff diverse opportunities for professional and personal development that will help them reinforce a sense of purpose while serving children and communities across the world. We welcome everyone who wants to belong and grow in a diverse and passionate culture., coupled with an attractive compensation and benefits package.

Visit our website to learn more about what we do at UNICEF.

For every child, a digital future

The overarching strategic goal of UNICEF’s Information and Communication Technology Division (ICTD) is to transform and build partnerships with our stakeholders to successfully implement UNICEF programmes globally through the use of innovative technology-enabled solutions. 

 

The implementation of Microsoft Purview directly supports this mandate by strengthening UNICEF’s digital governance and compliance framework. With its capabilities in data discovery, classification, protection, and lifecycle management, Purview provides the foundation for advancing UNICEF’s digital guardrails and safeguarding information assets.  

 

How can you make a difference? 

ICTD seeks a consultant to provide specialized expertise in advancing the implementation of Microsoft Purview across UNICEF’s global environment. Working in close collaboration with internal teams, the consultant will ensure the platform is effectively designed, deployed, and sustained, bringing deep knowledge of Microsoft Purview and Microsoft 365 technologies to strengthen UNICEF’s digital guardrails and support long-term organizational needs. 

 

Scope of Work:  

 

The consultant will work under the direction of the Information Governance manager and collaborate closely with technical teams and business stakeholders. The scope of work includes the following responsibilities: 

1. Configuration and Deployment

• Configure and deploy core Microsoft Purview services, including but not limited to:

• Information Protection (Sensitivity Labels, Label Policies)

• Data Loss Prevention (Endpoint, Exchange, SharePoint, Teams)

• Insider Risk Management

• Communication Compliance

• Data Lifecycle Management (Retention and Records Management)

• Data map and catalog

• Perform test deployments for each service, iteratively validating configuration prior to enterprise rollout.

• Document service configuration, dependencies, and rollout checklists for each implemented component as needed.

2. Operationalization and Governance

• Develop and deliver an Operationalization Framework covering:

• Compliance and Data Governance runbooks

• Service ownership and escalation paths

• Signal response workflows

• Role-based access and segregation of duties

• Define governance controls with accompanying policy templates (e.g., label lifecycle, retention review, access controls).

• Build reusable policy templates and configuration baselines to support scaling and decentralization of governance efforts, where applicable.

3. Signal Analysis and Response Design

• Analyze and triage signals across DLP, Insider Risk, and Compliance portals for a period.

• Support the development of at least 12 response workflows tied to real or simulated policy match events.

• Provide guidance on integrating signals into SIEM/SOAR platforms (e.g., Microsoft Sentinel, Defender) where applicable.

4. Business Engagement and Feedback Loop

• Conduct up to 10 structured engagements with business units to:

• Validate policy impact and usability

• Refine alerting thresholds and rule logic

• Align Purview configurations to operational needs and risk tolerance

• Capture business feedback using standardized templates and incorporate findings into final policy recommendations.

5. Knowledge Transfer and Documentation

• Deliver a minimum of 6 targeted briefing sessions for internal stakeholders (e.g., Digital Core administrators, SEC team, other roles as defined).

6. Strategic Alignment and Roadmap

• Draft a strategic roadmap for Purview operational maturity, including:

• Short-, medium-, and long-term goals

• Integration opportunities

• Resource planning and capacity considerations

• Implement MPARR, and success indicators for ongoing monitoring and assessment..

 

 

Work Assignments Overview	Deliverables/Outputs	Delivery  deadline
Foundational Planning and Environment Readiness	– Confirmed implementation scope and priorities across Microsoft Purview services.  – Initial baseline configuration of core compliance center settings and permissions.  – Installation, configuration, and validation of the Microsoft Purview Advanced Rich Reports (MPARR) Collector, including setup of data pipelines and report delivery mechanisms.  – Planning in DevOps outlining engagement model, resource dependencies, and rollout schedule  – Draft Operationalization Framework and runbooks.	Months 1-2
Service Deployment and Technical Validation	– Deployment and testing of all selected Microsoft Purview modules (e.g., Sensitivity Labels, DLP, Insider Risk, eDiscovery, Retention, Audit, Communication Compliance, Compliance Manager, Data Catalogs).  – Test iterations per service completed.  – Documentation and validation reports for each module, as required.  – Integration readiness assessments	Months 2-9
Signal Analysis and Response Development	– Analysis and triage of alerts and telemetry from DLP, Insider Risk modules.  – Development and testing of 12 response playbooks.  – Draft integration plan with SIEM/SOAR tools such as Microsoft Sentinel, Defender.  – Support for alert tuning and policy refinement.	Months 2-6
Business Engagement and Use Case Refinement	– Up to 10 structured engagements with business units to validate use cases, refine policies, and gather feedback.  – Documentation of findings and alignment of governance configurations to operational risk and business needs.  – Recommendations for iterative policy improvement.	Months 2-8
Knowledge Transfer and Documentation	Delivery of at least 6 briefing  sessions for technical and business  stakeholders.	Months 6-12
Governance Enablement and Strategic Planning	– Finalization of reusable policy templates and governance controls.  – Definition of operational roles, ownership, and escalation paths.  – Delivery of a strategic roadmap with success metrics and risk mitigation strategies.  – Engagement closeout report with sustainability recommendations.	Months 1-12

 

To qualify as an advocate for every child you will have… 

Minimum requirements:

Work Experience: 

• Demonstrated expertise in Microsoft Purview, including configuration of Information Protection, DLP, Insider Risk, Data Catalog, and Data Lifecycle Management.
• Practical experience installing and using MPARR (Microsoft Purview Advanced Rich Reports) Collector.
• Strong understanding of compliance signal analysis and development of response workflows.
• Ability to engage with business stakeholders to refine policies and operationalize compliance controls.
• Experience creating reusable templates, SOPs, and operational governance models.
• Proven ability to deliver briefings and documentation to technical and non-technical audiences.
• Microsoft Certified: Information Protection Administrator Associate (SC-400) certification desired (or equivalent demonstrable experience).
• Strong communication and cross-functional collaboration skills.

Language Requirement: Fluency in English (verbal and written) is required.

 

For every Child, you demonstrate…

UNICEF’s Core Values of Care, Respect, Integrity, Trust and Accountability and Sustainability (CRITAS) underpin everything we do and how we do it. Get acquainted with Our Values Charter: UNICEF Values

The UNICEF competencies required for this post are…

(1) Builds and maintains partnerships

(2) Demonstrates self-awareness and ethical awareness

(3) Drive to achieve results for impact

(4) Innovates and embraces change

(5) Manages ambiguity and complexity

(6) Thinks and acts strategically

(7) Works collaboratively with others 

 

Familiarize yourself with our competency framework and its different levels.

UNICEF promotes and advocates for the protection of the rights of every child, everywhere, in everything it does and is mandated to support the realization of the rights of every child, including those most disadvantaged, and our global workforce must reflect the diversity of those children. The UNICEF family is committed to include everyone, irrespective of their race/ethnicity, disability, gender identity, sexual orientation, religion, nationality, socio-economic background, minority, or any other status.

UNICEF encourages applications from all qualified candidates, regardless of gender, nationality, religious or ethnic backgrounds, and from people with disabilities, including neurodivergence. We offer a wide range of benefits to our staff, including paid parental leave, breastfeeding breaks and reasonable accommodation for persons with disabilities. UNICEF provides reasonable accommodation throughout the recruitment process. If you require any accommodation, please submit your request through the accessibility email button on the UNICEF Careers webpage Accessibility tendersglobal.net UNICEF. Should you be shortlisted, please get in touch with the recruiter directly to share further details, enabling us to make the necessary arrangements in advance.

UNICEF does not hire candidates who are married to children (persons under 18). UNICEF has a zero-tolerance policy on conduct that is incompatible with the aims and objectives of the United Nations and UNICEF, including sexual exploitation and abuse, sexual harassment, abuse of authority and discrimination based on gender, nationality, age, race, sexual orientation, religious or ethnic background or disabilities. UNICEF is committed to promote the protection and safeguarding of all children. All selected candidates will, therefore, undergo rigorous reference and background checks, and will be expected to adhere to these standards and principles. Background checks will include the verification of academic credential(s) and employment history. Selected candidates may be required to provide additional information to conduct a background check, and selected candidates with disabilities may be requested to submit supporting documentation in relation to their disability confidentially.

UNICEF appointments are subject to medical clearance.  Issuance of a visa by the host country of the duty station is required for IP positions and will be facilitated by UNICEF. Appointments may also be subject to inoculation (vaccination) requirements, including against SARS-CoV-2 (Covid). Should you be selected for a position with UNICEF, you either must be inoculated as required or receive a medical exemption from the relevant department of the UN. Otherwise, the selection will be canceled.

Remarks:  

As per Article 101, paragraph 3, of the Charter of the United Nations, the paramount consideration in the employment of the staff is the necessity of securing the highest standards of efficiency, competence, and integrity.

UNICEF is committed to fostering an inclusive, representative, and welcoming workforce. For this position, eligible and suitable female applicants are encouraged to apply.

Government employees who are considered for employment with UNICEF are normally required to resign from their government positions before taking up an assignment with UNICEF. UNICEF reserves the right to withdraw an offer of appointment, without compensation, if a visa or medical clearance is not obtained, or necessary inoculation requirements are not met, within a reasonable period for any reason. 

UNICEF does not charge a processing fee at any stage of its recruitment, selection, and hiring processes (i.e., application stage, interview stage, validation stage, or appointment and training). UNICEF will not ask for applicants’ bank account information.

 

All UNICEF positions are advertised, and only shortlisted candidates will be contacted and advance to the next stage of the selection process. An internal candidate performing at the level of the post in the relevant functional area, or an internal/external candidate in the corresponding Talent Group, may be selected, if suitable for the post, without assessment of other candidates.

Additional information about working for UNICEF can be found here.