Sr. MS 365 Systems Engineer / Architect

The ideal candidate is an expert in cloud architecture who can evaluate our existing tenant, enforce zero-trust security controls, optimize modern device management via Intune, and implement thorough compliance policies. Endpoint Management & Cloud Deployment Design and deploy enterprise configuration, compliance, and application protection profiles within Microsoft Intune across Windows, macOS, and mobile operating systems.

Job Description

Title: Sr. MS 365 Systems Engineer / Architect
Location: Hybrid / Irvine, CA

Ekman Associates is a management consulting firm that specializes in developing business, digital, and technology strategy, delivering solutions, and addressing human resource demands.

Summary:
We are seeking a senior-level Microsoft 365 Systems Engineer / Architect. In this role, you will act as the principal technical authority for our cloud infrastructure, driving advanced optimization, security remediation, and operational governance across our entire cloud-native Microsoft 365 ecosystem. The ideal candidate is an expert in cloud architecture who can evaluate our existing tenant, enforce zero-trust security controls, optimize modern device management via Intune, and implement thorough compliance policies.

Responsibilities:

Cloud Identity & Access Governance

• Audit and optimize the core Microsoft Entra ID configuration, reinforcing enterprise best practices for cloud-only identity structures.
• Architect and implement robust Conditional Access Policies (CAPs), deploy phishing-resistant Multi-Factor Authentication (MFA), and configure Entra ID Protection policies.
• Standardize global administrative roles using Privileged Identity Management (PIM) and configure secure external collaboration settings.

Endpoint Management & Cloud Deployment

• Design and deploy enterprise configuration, compliance, and application protection profiles within Microsoft Intune across Windows, macOS, and mobile operating systems.
• Streamline hardware provisioning infrastructure using cloud-native deployment methods including Windows Autopilot and Apple Business Manager.
• Set up automated patch management via Windows Update for Business and establish standardized security baselines.

Collaboration, Messaging & Content Compliance

• Review and maximize the performance, structural organization, and sharing configurations of Exchange Online, SharePoint Online, and Microsoft Teams.
• Configure Microsoft Purview Data Loss Prevention (DLP) rules, sensitivity labels, and retention schedules to safeguard intellectual property.
• Enforce robust tenant governance models including Microsoft Teams lifecycle automation, guest access reviews, and application permission policies.

Security Engineering & Documentation

• Systematically remediate tenant vulnerabilities to improve the organization's overall Microsoft Secure Score and security posture.
• Configure comprehensive audit logs, alert notifications, and diagnostic data integrations with core security monitoring systems.
• Author technical as-built architecture manuals, governance charters, and clear operational runbooks to ensure an effective handover to internal IT personnel at project conclusion.

Qualifications:

• Experience Profile: Minimum 8+ years of enterprise systems engineering experience, with at least 5+ years dedicated strictly to cloud-native Microsoft 365 infrastructure and architecture design.
• Cloud-Only Specialization: Proven mastery managing pure cloud environments with zero hybrid constraints (no local Active Directory, no hybrid Exchange servers, and no write-back dependencies).
• Identity & Access Management: Expert-level knowledge of Microsoft Entra ID governance, Conditional Access design parameters, and identity boundary security.
• Unified Endpoint Management: Extensive experience engineering worldwide device fleets using Microsoft Intune, provisioning workflows, and custom app deployments.
• Information Governance: Direct hands-on proficiency executing data protection policies via Microsoft Purview, records management, and discovery engines.
• Automation Engineering: Strong PowerShell scripting skills utilizing the native Microsoft Graph SDK and modern API endpoints to automate tenant configuration management.

Preferred Certifications

• Microsoft Certified: Microsoft 365 Enterprise Administrator Expert
• MCSA, MCSE

Qualified Candidates Only : If you wish to learn more about this opportunity and additional qualifications/responsibilities, please submit your resume. To learn more about Ekman Associates, Inc. please visit our website at www.ekmanassociates.com .