Azure_M365_Security_Engineer

Role & responsibilities

• Roll out MFA on email, remote access and admin accounts first, then to all users, with Conditional Access policies that allow only managed devices.
• Clean up identity: remove stale admin rights and leaver accounts, set up role-based admin, and enforce same-day offboarding.
• Configure Intune device compliance and enrollment for Windows laptops, working with the endpoint engineer on the standard build.
• Set up alerting on bulk downloads, impossible travel and unusual sign-ins in Microsoft 365 and connected SaaS apps.
• Apply data protection (sensitivity labels, DLP) for staff who handle patient data, scoped rather than tenant-wide.
• Harden Azure and M365 tenant settings against Secure Score and CIS benchmarks; document every change.
• Support license right-sizing with evidence of which features each user group actually needs.

Preferred candidate profile

• 5+ years in Microsoft identity and cloud security.
• Hands-on with Entra ID (Conditional Access, PIM, MFA methods), Intune, Exchange Online protection and the M365 admin and security centers.
• Can explain which security features sit in which M365 license (E3, E5, F3, Entra P1/P2) and design around a license constraint.
• PowerShell or Graph API scripting for bulk changes and reporting.
• Has rolled out MFA to 1,000+ users with a measured adoption and support plan.