Azure_M365_Security_Engineer
Posted Updated
Summary
Microsoft security engineer who rolls out MFA and Conditional Access, cleans up identity/admin rights, configures Intune device compliance, and hardens the Azure/M365 tenant against CIS benchmarks — including DLP and sensitivity labels for staff handling patient data. Core stack: Entra ID, Intune, Exchange Online, PowerShell/Graph API.
Role & responsibilities
- Roll out MFA on email, remote access and admin accounts first, then to all users, with Conditional Access policies that allow only managed devices.
- Clean up identity: remove stale admin rights and leaver accounts, set up role-based admin, and enforce same-day offboarding.
- Configure Intune device compliance and enrollment for Windows laptops, working with the endpoint engineer on the standard build.
- Set up alerting on bulk downloads, impossible travel and unusual sign-ins in Microsoft 365 and connected SaaS apps.
- Apply data protection (sensitivity labels, DLP) for staff who handle patient data, scoped rather than tenant-wide.
- Harden Azure and M365 tenant settings against Secure Score and CIS benchmarks; document every change.
- Support license right-sizing with evidence of which features each user group actually needs.
Preferred candidate profile
- 5+ years in Microsoft identity and cloud security.
- Hands-on with Entra ID (Conditional Access, PIM, MFA methods), Intune, Exchange Online protection and the M365 admin and security centers.
- Can explain which security features sit in which M365 license (E3, E5, F3, Entra P1/P2) and design around a license constraint.
- PowerShell or Graph API scripting for bulk changes and reporting.
- Has rolled out MFA to 1,000+ users with a measured adoption and support plan.