M365 Security Engineer

What You Will Do: Engineer, test, and deploy Intune configuration and compliance policies across Windows, macOS, and iOS/iPadOS, including Enrollment Status Pages and OOBE workflows Design and validate device compliance based Conditional Access policies in Entra ID, and troubleshoot CAP failures, identity anomalies, and B2B guest access issues Lead integration and tuning of Microsoft Defender (XDR, Endpoint, Cloud Apps) and Microsoft Sentinel, including analytic rules, alert logic, audit retention, and connectors Build SIEM ingestion pipelines for third party log sources using Azure Function Apps and Log Analytics Write Power Shell remediation scripts to close compliance gaps, deploy CVE fixes, and enforce security baselines (for example NTLM disablement)Own data protection governance in Microsoft Purview: classification, sensitivity labeling, retention, and DLPSecure Exchange Online mail flow, encryption (S/MIME and/or MIP), and anti spam, anti phishing, and anti malware protections Support ATO and control assessments by drafting implementation statements and assembling evidence packages Provide Tier 3 support on device compliance, identity, telemetry, and app protection incidents, and coordinate enterprise rollout of urgent vulnerability mitigations Partner with Cyber, Ops, Enterprise Architecture, ICAM, and Comms teams, and keep Jira, Confluence, and change requests current Required Bachelor's degree and 8+ years of experience, or 12+ years of experience in lieu of a degreeUS Citizen or US based person able to obtain a Public Trust (Level 5)Deep, hands on experience with Microsoft Defender (XDR, Endpoint, Cloud Apps)Hands on Microsoft Sentinel SIEM experience, including cross platform telemetry pipelines Expert level Intune engineering across Windows, macOS, and iOS/iPadOSAdvanced Power Shell for remediation, automation, and OS image manipulation Strong understanding of Conditional Access architecture and identity risk enforcement in Entra IDExperience producing ATO control evidence, compliance mapping, and audit support Clear communicator who can summarize technical issues in terms of user impact and stay steady during high severity events Preferred Federal, high compliance, or high assurance environment experience (GCC or GCC High a strong plus)Jamf, Okta connectors, Copilot audit logging, and Microsoft Graph API operationsmacOS security hardening and mSCP baseline engineering Prior ownership of an enterprise wide Conditional Access rollout