Senior Microsoft Engineer – Azure, M365, Security

This is a fully remote position, open to applicants in Sri Lanka.

📋 Description

• Act as the primary escalation point for intricate incidents involving Microsoft Intune, Microsoft 365, Entra ID, Microsoft Defender, and Azure.

• Analyze and resolve advanced issues related to endpoint management, identity, authentication, security, cloud infrastructure, and Microsoft services.

• Lead root-cause analysis and problem management efforts while implementing lasting solutions.

• Collaborate with Microsoft Support and third-party vendors as required.

• Offer technical guidance and troubleshooting assistance to Level 1 and Level 2 engineers.

• Establish, sustain, and enhance Microsoft security and configuration baselines across customer environments.

• Standardize configurations across Intune, Microsoft 365, Entra ID, Microsoft Defender, and Azure.

• Implement and optimize Conditional Access, Multi-Factor Authentication (MFA), endpoint protection, device compliance, and privileged access controls.

• Monitor configuration drift, security vulnerabilities, and deviations from approved standards.

• Identify and implement security enhancements using Microsoft Secure Score, Defender recommendations, and various security frameworks.

• Keep track of Microsoft product updates, roadmap changes, feature releases, deprecations, and security advisories.

• Suggest infrastructure modernization, endpoint management enhancements, security upgrades, and licensing optimization.

• Prepare technical recommendations that address issues, improvements, benefits, risks, and implementation considerations.

• Support proactive customer engagement and assist in technology roadmap planning.

• Manage multiple commercial customer environments utilizing multi-tenant management tools.

• Oversee delegated administrative access through Granular Delegated Admin Privileges (GDAP) and maintain permissions and governance controls.

• Utilize Microsoft 365 Lighthouse and Azure Lighthouse across customer tenants.

• Perform tenant security reviews, compliance assessments, and configuration enhancements.

• Develop and maintain PowerShell scripts and integrations with Microsoft Graph API.

• Create reusable automation solutions for configuration, reporting, monitoring, and remediation.

• Document automation solutions thoroughly.

• Mentor Level 1 and Level 2 engineers.

• Create technical runbooks, standard operating procedures, troubleshooting guides, and knowledge base articles.

• Conduct peer reviews of technical changes, scripts, and configurations.

• Lead knowledge-sharing initiatives and contribute to professional development.

• Evaluate technical changes and validate implementation plans, testing, dependencies, and rollback procedures.

• Support post-change reviews and apply lessons learned.

⛳️ Requirements

• Minimum of 7 years in systems engineering, cloud engineering, or managed IT services, with substantial experience in senior technical support or Level 3 engineering.

• Proven experience working within a Managed Service Provider (MSP), supporting various commercial customer environments.

• Strong grasp of managed services operations, incident management, problem management, and change management.

• Demonstrated capacity to manage complex technical issues, perform root-cause analysis, and deliver sustainable solutions.

• Advanced hands-on experience with Microsoft Intune and Microsoft Endpoint Manager.

• In-depth knowledge of Windows Autopilot, device enrollment, configuration profiles, compliance policies, application deployment, and Windows 10/11 administration.

• Experience with endpoint security, device lifecycle management, update management, and Microsoft Defender for Endpoint integration.

• Advanced administration and troubleshooting skills across Microsoft 365, including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams.

• Familiarity with Microsoft 365 licensing, including Business Premium, E3, and E5.

• Understanding of Microsoft Purview, including Data Loss Prevention (DLP) policies and sensitivity labels.

• Extensive expertise in identity and access management, authentication, identity protection, and access governance.

• Advanced experience in implementing and troubleshooting Conditional Access, Multi-Factor Authentication (MFA), and Single Sign-On (SSO).

• Knowledge of hybrid identity, Entra Connect, directory synchronization, authentication protocols, role-based access control, and least-privilege security models.

• Familiarity with Granular Delegated Admin Privileges (GDAP) and delegated administration across multiple customer tenants.

• Strong hands-on experience with Microsoft Defender for Endpoint and the wider Microsoft Defender security ecosystem.

• Experience in implementing endpoint protection, attack surface reduction, vulnerability management, and security policies.

• Knowledge of Microsoft Defender for Office 365, Microsoft Defender XDR, Zero Trust principles, and Microsoft security best practices.

• Ability to assess Microsoft Secure Score and implement recommendations to enhance security posture.

• Significant experience in administering and troubleshooting Azure environments, including virtual machines, networking, storage, backup, monitoring, and resource management.

• Knowledge of Azure role-based access control, Azure Policy, security configuration, governance, and cost management.

• Familiarity with Azure Lighthouse and multi-tenant Azure administration.

• Advanced PowerShell scripting capabilities.

• Strong experience with Microsoft Graph API.

• Capability to develop, troubleshoot, and maintain secure, reusable, and well-documented scripts and automated processes.

• Familiarity with the Australian Signals Directorate (ASD) Essential Eight framework.

• Experience implementing Microsoft security controls to support Essential Eight maturity improvements.

• Exposure to Microsoft Sentinel, Log Analytics, advanced security monitoring, and broader Microsoft Purview compliance capabilities.

• Familiarity with multi-tenant management platforms, including Microsoft 365 Lighthouse, Azure Lighthouse, and PSA/RMM tools such as ConnectWise, HaloPSA, Autotask, NinjaOne, or Datto RMM.

• Experience in contributing to customer technology roadmaps, security improvement plans, and Microsoft licensing reviews.

• Understanding of ITIL-aligned service management practices.

• Preferred certifications include MD-102, MS-102, and AZ-104.

• Additional certifications such as SC-300 and AZ-500 are advantageous.

• Equivalent practical experience and technical knowledge are also valued.

🏝️ Benefits

• Receive payment in Australian Dollars.

• Medical insurance from day one for you and your spouse (or parents if unmarried).

• Generous Outpatient Department (OPD) coverage for doctor visits and all your medical needs.

• Home office setup allowance provided.

• Internet allowance to support your work.

• Gym and wellness allowance available.

• Regular team events and engagement activities to foster community.

• Diji Assist mental health and counseling support offered.

• Reimbursement for industry certifications encouraged.

• Flexible work options – whether from home or the office.

• Rewards and recognition for your achievements.

• Celebrate with Christmas and financial year-end parties.