Cloud Workplace Engineer

Nebius

About The Position

Nebius is hiring a Cloud Workplace Engineer to own the company’s identity provider and access lifecycle. Microsoft Entra ID is the primary identity platform, with Google Workspace, Cloud Identity, and Google Cloud IAM as substantial additional domains. The role owns federation and provisioning between these platforms, as well as Microsoft 365 tenant, licensing, and access administration. The engineer is the escalation point for identity incidents raised by operations, security, service desk, and application teams, and is expected to resolve issues directly. The position covers identity and access administration, authentication and access policies, application integrations and provisioning, lifecycle automation, least-privilege governance, service and workload identity controls, diagnostics, and cross-tenant collaboration. It also involves production-quality automation using Microsoft and Google APIs and cloud workflow tools, with version control, peer review, documentation, and rollback planning. Nebius describes itself as a cloud infrastructure company building a full-stack AI cloud platform. It is listed on Nasdaq, headquartered in Amsterdam, and has a global footprint with R&D hubs across Europe, the UK, North America, and Israel. The company has more than 1,500 team members, including hundreds of engineers.

Requirements

At least 3 years administering Microsoft Entra ID in production as a primary responsibility.
Experience with enterprise applications, app registrations, consent and permission models, and automated provisioning.
Microsoft 365 administration experience, including tenant settings, licensing, admin roles, and access troubleshooting across Exchange Online, SharePoint Online, and Power Platform.
Google Workspace and Cloud Identity administration experience, including organizational units, groups, admin roles, SSO profiles, and access settings.
Google Cloud IAM experience with projects, roles and policies, service accounts, API access, and OAuth credentials.
Strong PowerShell skills using the Microsoft Graph PowerShell SDK and direct REST API work.
Experience with Azure Automation Runbooks, Azure Logic Apps, Power Automate, or comparable platforms.
Knowledge of least privilege and secure administration, with experience or discipline in change management and documenting configurations.
Ability to diagnose SAML assertion or JWT failures, including audience mismatches, NameID format problems, expired signing certificates, and missing claims.
Ability to diagnose SCIM provisioning failures across scoping, attribute mapping, transformations, and target schemas.
Ability to build reliable lifecycle automation with logging and retries that can be handed off to another operator.

Nice To Haves

SC-300, MS-102, or SC-401 certification, or equivalent demonstrable expertise.
Microsoft Entra ID Governance experience, including entitlement management, lifecycle workflows, and Privileged Identity Management.
Experience with Microsoft Purview, including DLP, retention, or eDiscovery; Microsoft Defender for Cloud Apps; or Microsoft Sentinel.
Google Cloud workload identity federation, custom roles, or organization policy constraints experience.
Experience with Git, CI/CD practices, Pester, Bicep, or Terraform.
Experience providing access evidence for SOC 2, ISO 27001, or comparable audit cycles.

Responsibilities

Own Microsoft Entra ID users, groups, administrative units, directory roles, service principals, and workload identities.
Design and roll out Conditional Access policies, including named locations, client and platform conditions, session controls, sign-in frequency, break-glass exclusions, and report-only staging.
Manage authentication methods policies and phishing-resistant factors.
Onboard applications using SAML 2.0 and OIDC/OAuth 2.0, including claims, certificates, authorization flows, and client credentials.
Manage app registrations, redirect URIs, permissions, admin consent workflows, and secret and certificate lifecycles.
Configure and troubleshoot SCIM 2.0 provisioning, including attribute mappings, scoping filters, expression transformations, quarantined jobs, and drift reconciliation.
Review tenant consent settings and OAuth grants; remediate over-permissioned or stale applications and establish controls for SaaS applications without SSO or SCIM support.
Automate joiner-mover-leaver processes, including provisioning, group-based licensing, and revocation with session and refresh-token invalidation.
Apply least-privilege controls for administrative access through scoped role assignments, RBAC, PIM, access reviews, and entitlement management access packages.
Govern service accounts and workload identities, including ownership, credential rotation, permission scoping, and decommissioning.
Administer Microsoft 365 tenant settings, licensing, and admin roles, and troubleshoot access and permission issues across Exchange Online, SharePoint Online, and Power Platform.
Diagnose issues using sign-in, audit, and provisioning logs; route diagnostic settings to Log Analytics and use KQL queries.
Manage cross-tenant access settings and B2B external collaboration.
Administer Google Workspace and Cloud Identity users, groups, organizational units, administrator roles and privileges, licensing, 2-Step Verification, and session controls.
Configure third-party SSO profiles using Microsoft Entra ID as a SAML identity provider, automate provisioning into Cloud Identity, and manage OU- and group-scoped SSO exclusions.
Manage Context-Aware Access policies, third-party OAuth app access, domain-wide delegation, and Drive sharing and external access controls.
Administer Google Cloud IAM project and folder membership, roles, allow policies, service accounts and key hygiene, workload identity federation, API enablement, and OAuth clients.
Develop PowerShell automation with the Microsoft Graph PowerShell SDK and Graph REST API for lifecycle, licensing, access reporting, and recertification.
Automate Google-side tasks through the Admin SDK Directory API, Cloud Identity API, and gcloud.
Build scheduled and event-driven workflows using Azure Automation Runbooks, Azure Logic Apps, Power Automate, or comparable platforms.
Run unattended automation using managed identities and narrowly scoped app registrations, with credential rotation, structured logging, error handling, and retries.
Treat automation as production code through version control, peer review, and documented rollback.
Decode SAML assertions or JWTs and diagnose authentication failures without escalating to a vendor.
Diagnose failing SCIM jobs and identify whether the issue is in scoping, attribute mapping, transformation expressions, or the target schema.
Replace manual lifecycle processes with automation that logs, retries, and can be operated by others.
Document configurations and follow least-privilege, secure administration, and change-management practices.
Serve as the identity incident escalation point for operations, security, service desk, and application teams, resolving incidents directly.