Sr Engineer M365 Platform

Senior Engineer - M365 Platform - Entra and Active Directory SME provides engineering, design, and implementation services for the enterprise hybrid identity estate spanning Microsoft Entra ID and Active Directory and is the subject matter expert for Entra as the organization moves to a cloud-first, Entra-authoritative operating model. This position owns identity-plane engineering across both directories during migration and de-hybridization: greenfield forest and tenant integration, directory synchronization topology, modern authentication, Conditional Access, privileged access, and the retirement of legacy on-premises identity dependencies. Acts as the senior escalation point for identity issues, completing assigned change requests and converting recurring problems into permanent engineering fixes. Applies new solutions through research and collaboration with the team, and determines the course of action for new application initiatives. Implements and documents new solutions as required by the business to improve the end user operating experience. The core infrastructure technology duties include enterprise Entra ID and Active Directory, modern authentication (OAuth 2.0, OIDC, SAML, WS-Federation), Conditional Access and phishing-resistant multifactor authentication, privileged access (Entra PIM, Tier 0 / Enterprise Access Model), Business-2-Business collaboration with external partners, application and workload identity onboarding, and license optimization. Expert knowledge is required across the following areas: Entra ID (Azure AD); Conditional Access Policies (CAPs); Entra Connect and Entra Cloud Sync; Active Directory (AD); Group Policy Objects (GPO); Entra Single Sign-On (SSO); Certificate Authorities (CA) and Public Key Infrastructure (PKI); Dynamic Host Configuration Protocol (DHCP); Domain Name System (DNS); Distributed File System (DFS); and Windows Server 2016, 2019, 2022, and 2025.

Environment and Scope: the estate supports approximately 20,000 users across four on-premises Active Directory domains, with a primary production tenant and a separate development tenant. Active work consists of a greenfield domain build, migration off the four legacy domains, and a full cleanup and re-architecture of the Entra tenants. The required skill set is deliberately broad and covers the full directory, authentication, and platform range rather than a single specialty. This is a build role rather than a maintenance role, and it carries the opportunity to fully own and remake the environment for the engineer who can operate at that level.

* Own the design, engineering, and implementation of the enterprise identity plane across Entra ID and Active Directory, and serve as the organization's final internal technical authority on Entra.
* Plan and execute the move to a cloud-first, Entra-authoritative model: greenfield forest and tenant standup, coexistence design, wave-based user and workload cutover, and staged de-hybridization of on-premises identity dependencies.
* Design, pilot, and enforce Conditional Access and phishing-resistant authentication at enterprise scale, using report-only staging and What-If validation ahead of enforcement, and retire legacy authentication paths.
* Engineer privileged access to eliminate standing administrative privilege, implementing PIM, the Enterprise Access Model, and least-privilege role and administrative unit scoping.
* Onboard applications and workload identities to modern authentication and SSO, right-size application permissions, and remove long-lived credentials and legacy protocol dependencies.
* Build and maintain identity automation in PowerShell and Microsoft Graph under version control with peer review, replacing manual administrative processes.
* Track the Microsoft identity roadmap, Message Center announcements, and product deprecation timelines, and convert them into remediation plans and change requests ahead of Microsoft-forced deadlines.
* Produce design documentation, security and architecture review artifacts, and runbooks, and transition completed builds to Operations with the documentation and enablement required to run them.
* Serve as the senior escalation point for identity incidents, performing root cause analysis and delivering permanent engineering remediation rather than repeat manual intervention.
* Maintain identity resilience: Active Directory forest recovery planning, Entra tenant configuration backup and restore, break-glass account lifecycle, and periodic recovery testing.
* Partner with Security, Endpoint, Network, Identity Governance, and application teams on identity-dependent initiatives, and manage Microsoft and external advisory engagements without ceding internal design ownership.
* Mentor engineers and administrators on Entra and Active Directory practice, raising team capability through knowledge transfer and design review.

* Must have a minimum of 4 years of hands-on engineering experience with Entra ID at enterprise scale, within a minimum of 5 years of total Microsoft identity and directory platform experience that includes production Active Directory engineering.
* Attribute and object level knowledge of Active Directory, including schema, ACLs, SID history, and delegation models.
* Strong working knowledge of log analysis through KQL across Entra sign-in, audit, and provisioning logs.
* Extensive experience in design and troubleshooting of enterprise domains and tenants, including authentication, site layout, PKI and certificates, migration, consolidation, tenant-to-tenant and forest-to-forest consolidation, automation of access and access removal to various applications and/or authorities.
* Experience planning and executing migration from on-premises Active Directory to a cloud-native Entra ID model, including greenfield forest and tenant standup, coexistence, wave-based cutover, and de-hybridization of legacy identity dependencies.
* Working knowledge of directory synchronization design and operation - Entra Connect Sync, Entra Cloud Sync, staging mode, synchronization rules, filtering, source-of-authority transitions, and Entra Connect Health.
* Working knowledge of hybrid and cloud join models, including Entra hybrid join, Entra join, and cloud-native Windows provisioning with Autopilot and Intune, in coordination with Endpoint Engineering.
* Ability to analyze deployment articles and GitHub repositories to understand and implement identified configurations.
* Develop automation routines to replace manual processes and increase efficiency, using PowerShell and Microsoft Graph.
* Demonstrated knowledge of authentication, security, privacy, and compliance and how they factor into cloud and hybrid solutions.
* Strong working knowledge of network architecture and standards for large enterprise deployments and understanding of security and regulatory frameworks relevant to IT standards (PCI DSS, SOX, and CPNI).
* Interface with support, operations, and end users as needed to diagnose escalated problems and to validate engineering changes in production.
* Backup and Disaster Recovery experience, including Active Directory forest recovery and Entra ID tenant-level configuration backup and restore.
* Escalate problems to management and/or vendors in a timely fashion.
* Develop techniques and implement resolution of problems based on root cause analysis.
* Follow established Change Control procedures to document all production changes, and to limit unexpected interruptions to the production environment.
* Ability to prepare design documentation for security architecture and technical architecture review, and to work alongside external architecture-advisory partners without ceding internal design ownership.
* Degree in Computer Science or equivalent work experience.
* Experience in architecture and design of enterprise IT infrastructure.