Cloud Operational Engineer, Level 3

This is a fully remote position, open to applicants in Philippines.

📋 Description

• Triage and address platform alerts related to availability, performance, capacity, and configuration drift.

• Assess which alerts indicate genuine service issues and respond appropriately.

• Transform recurring alert trends into problem records and candidates for automation.

• Take ownership of operational responses for managed file transfers and scheduled job failures, including reruns, validation, and client communication.

• Manage Entra ID user and guest lifecycle, group memberships, cross-tenant collaboration, attribute, and licensing modifications.

• Oversee Azure RBAC and PIM role assignments along with time-limited privileged access.

• Create app registrations and service principals; manage secrets, certificates, API permissions, and admin consent.

• Proactively rotate and renew secrets and certificates.

• Investigate Conditional Access and MFA authentication failures and assist in security investigations.

• Operate Microsoft 365 services, including Exchange Online mail flow, shared mailboxes, distribution lists, quarantine, anti-spam, SharePoint, OneDrive, and Teams policy and governance.

• Manage DNS records, domain onboarding, SPF, DKIM, and DMARC configurations.

• Handle access and permissions across Microsoft Fabric, Databricks, Snowflake, and Azure SQL.

• Configure and manage enterprise applications, SAML federation, and SCIM provisioning.

• Oversee Intune configuration and application deployment across Windows, macOS, iOS, and Android platforms.

• Troubleshoot Azure Virtual Desktop and Cloud PC sessions and profiles.

• Resolve availability, performance, access, and capacity issues across existing virtual machine environments.

• Serve as the technical lead during major incidents, providing client-facing technical communication.

• Conduct root cause analysis and implement preventive measures for significant and recurring incidents.

• Identify systemic risks and convert recurring failure patterns into problem records.

• Escalate to Engineering with clear symptoms, diagnostics, hypotheses, and specific requests.

• Author and maintain runbooks, operational standards, troubleshooting guidance, and escalation criteria.

• Review and validate Tier 1 and Tier 2 runbooks, identifying tasks that can be delegated to a lower tier.

• Maintain Confluence documentation validated against the live environment.

• Log requested, completed, and verified work before closure.

• Identify and eliminate repetitive operational tasks through scripting and automation.

• Develop and maintain reliable, idempotent, well-commented, and rerunnable PowerShell automation.

• Suggest self-service and workflow automation for high-volume, low-complexity requests.

• Propose enhancements to monitoring and alerting based on evidence.

• Operate consistently across multiple client tenants while ensuring strict tenant isolation.

• Adhere to delegated administration, privileged access, and break-glass procedures.

• Apply standards consistently and identify environmental drift.

• Manage client data with care, supporting SOC 2, ISO 27001, and UK GDPR obligations.

• Oversee the operation, troubleshooting, configuration, and maintenance of live platforms, access and entitlement work, alert responses, runbook execution, problem management, standards, documentation, and automation.

• Note that client implementations, onboarding, migrations, infrastructure-as-code builds, network/firewall architecture, monitoring design, or first-time integration architecture are not part of this role.

⛳️ Requirements

• 6 to 10+ years of experience in cloud, identity, or workplace engineering, with proven time spent operating at L3 or subject matter expert level.

• Demonstrated experience as a final escalation point in a production environment with real service commitments.

• A degree or equivalent practical experience in IT or a related field.

• Expert-level administration of Microsoft 365, including Exchange Online mail flow, SharePoint, OneDrive, and Teams governance.

• Extensive hands-on expertise with Entra ID: authentication and authorization, Conditional Access, MFA, SSO, PIM, app registrations, service principals, and Microsoft Graph permissions.

• Strong operational capabilities in Azure, including RBAC, subscription and resource group management, virtual machines, storage, Key Vault, and Log Analytics.

• Expert knowledge of Microsoft Intune and endpoint management across Windows, macOS, iOS, and Android.

• Practical experience with Azure Virtual Desktop and Windows 365 Cloud PC, particularly in profile and session troubleshooting.

• Experience in identity integration, including SAML configuration, SCIM provisioning, and claims and attribute mapping.

• Knowledge of DNS administration and mail authentication records.

• Proficient in PowerShell automation to production standards, including Microsoft Graph PowerShell.

• Understanding of identity security and Zero Trust principles, applying least-privilege by default.

• Advanced troubleshooting skills and structured root cause analysis capabilities.

• Hands-on experience with ServiceNow is required.

• Familiarity with ITIL-aligned service management, covering incident, problem, change, and knowledge management.

• Active authoring experience on Confluence or an equivalent knowledge platform, rather than an occasional reader.

• Experience with monitoring and alerting platforms, such as Zabbix or Azure Monitor.

• Basic familiarity with Azure DevOps to manage access, repositories, and pipelines at an entitlement level.

• Prior experience in a managed service provider (MSP), managed service, or multi-tenant environment is required.

• Ability to work across multiple client tenants simultaneously while maintaining proper separation.

• Understanding of delegated administration, privileged access, and break-glass access models, including their audit implications.

• Awareness of the commercial aspects of managed services: SLAs, contracted scope, and accurate time and ticket records.

• Strong client-facing communication skills.

• Preferred certifications: Microsoft 365 Certified: Enterprise Administrator Expert (MS-102); Microsoft Certified: Identity and Access Administrator Associate (SC-300); Microsoft Certified: Azure Administrator Associate (AZ-104); Microsoft Certified: Endpoint Administrator Associate (MD-102).

• Advantageous certifications: Microsoft Certified: Azure Security Engineer Associate (AZ-500); Microsoft Certified: Security Operations Analyst Associate (SC-200); ITIL 4 Foundation.

• Experience in regulated sectors like insurance, financial services, or healthcare is advantageous.

🏝️ Benefits

• Complimentary lunch, fruits, snacks, and beverages.

• Onsite gym with a professional instructor available at no cost.

• Weekly fitness activities and an annual fitness challenge with prizes of up to 70,000 PHP.

• Weekly engagement activities with prizes reaching up to 3,000 PHP.

• Access to a free upskilling academy to enhance your performance and skillset.

• Modern facilities, from restrooms to workstations.

• Amenities including sleeping quarters, a game area, a chat room, and a shower room.