M365 Engineer

VFX Financial

5d•Hybrid

About The Position

VFX Financial is a rapidly growing FinTech company specializing in helping complex organizations manage cross-border financial transactions. The M365 Engineer will be responsible for VFX's Microsoft identity and endpoint environment, with a primary focus on identity security (Entra ID, Conditional Access, PIM) and endpoint management and security (Intune, Autopilot, EDR). Secondary responsibilities include automation, scripting, and M365 platform support, including SharePoint Online, Teams, eDiscovery, and Purview configuration. The role involves working with CrowdStrike Falcon for security monitoring and response, with comprehensive training provided. This position can be hybrid in Portimao or fully remote within Portugal.

Requirements

Typically 5+ years in Microsoft cloud, identity, or endpoint engineering, with demonstrable production ownership of Entra ID and Intune
Deep working knowledge of Entra ID: Conditional Access, PIM, identity governance, hybrid environments
Hands-on expertise with Microsoft Intune, Autopilot, and MDM/MAM policy management
Proficiency in PowerShell scripting for identity lifecycle and compliance automation
Solid understanding of Zero Trust architecture and practical implementation experience
Experience working with endpoint detection and response tooling in a production environment
Professional proficiency in English

Nice To Haves

Experience with CrowdStrike Falcon Identity Protection or equivalent identity threat detection tooling
Familiarity with SIEM platforms; we use CrowdStrike Falcon LogScale
Knowledge of NIST or CIS control frameworks applied to identity and endpoint
Experience with Microsoft Defender products alongside third-party security tooling
Exposure to GDPR technical controls (e.g. data classification, DLP, eDiscovery) in an M365 environment
Background in financial services or other regulated sectors
Microsoft Certified: Identity and Access Administrator Associate — SC-300 (strongly preferred)
Microsoft Certified: Endpoint Administrator Associate — MD-102 (strongly preferred)
Microsoft Certified: Security Operations Analyst Associate, SC-200 (advantageous)

Responsibilities

Own Entra ID: architecture, user and group lifecycle, hybrid Active Directory integration, and directory governance
Design, implement, and maintain Conditional Access policies enforcing Zero Trust access principles
Manage Privileged Identity Management: just-in-time access, role activation workflows, and regular access reviews
Work with our identity threat detection platform (CrowdStrike Falcon Identity Protection) to monitor for anomalies and respond to identity-based threats
Manage external identities, B2B collaboration policies, and cross-tenant access settings
Own periodic access reviews; ensure IAM controls remain current and evidenced for audit
Own the full lifecycle of Windows and mobile device management via Microsoft Intune and Autopilot — provisioning, configuration, compliance, patching, and decommissioning
Define and enforce device configuration profiles, security baselines, and compliance policies
Work with our EDR platform (CrowdStrike Falcon) — triage alerts, investigate incidents, and drive remediation alongside the SOC
Manage mobile application management controls to protect corporate data on personal and managed devices
Monitor endpoint health and security posture; proactively identify and remediate vulnerabilities and configuration drift
Develop and maintain PowerShell automation for identity lifecycle, compliance remediation, configuration drift detection, and operational self-healing
Build reusable automation solutions; maintain internal runbooks and operational documentation
Administer Exchange Online, SharePoint Online, and Microsoft Teams — security configuration, DLP policies, retention labels, and service health
Manage Microsoft 365 tenant configuration, licensing, and compliance centre settings
Support data protection requirements — eDiscovery, retention policies, and information protection labels — in collaboration with the DPO
Lead technical investigation and remediation for M365 platform incidents, working within VFX's incident-management process