Microsoft 365 Exchange & Messaging Architect

Cornell University • Ithaca, MI

1d • $107,682 - $131,611 • Remote

About The Position

Cornell University, unique among peers, is the federal land-grant institution of New York State, a private endowed university, and a member of the Ivy League. Information Technology (IT) is a strategic enabler for many functions at Cornell University, with staff located across colleges, administrative units, and campuses throughout the institution. While comprised of many organizations, IT operates as one partnering closely with faculty, staff, and students to support teaching, research, and business operations. By being embedded where the Cornell community is, IT is well positioned to provide support ranging from day‑to‑day needs to large, complex initiatives that advance major academic, research, and operational objectives across the university. The Microsoft 365 Exchange & Messaging Architect serves as a senior technical resource for Cornell University’s enterprise messaging and collaboration environment. This role designs, secures, automates, and supports Microsoft 365 Exchange Online, Exchange hybrid infrastructure, mail routing, identity integration, and related communication services. The position provides advanced technical guidance, resolves complex service issues, maintains reliable operational practices, and partners with security, legal, vendor, and campus stakeholders to support resilient communication services across the university.

Requirements

• Bachelor’s degree in Computer Science, Information Technology, or a related field and 5 to 8 years of relevant IT infrastructure experience, including experience supporting enterprise Exchange, Microsoft 365, or Exchange Online environments. or an equivalent combination of education and experience.
• Demonstrated experience supporting or leading enterprise Microsoft 365 migration projects, such as cross-tenant migrations or on-premises to cloud transitions.
• Expert-level knowledge of Exchange Online, Exchange Server (2019/2022), and Hybrid deployment models.
• Advanced PowerShell & Microsoft Graph API scripting capability for production automation.
• Deep proficiency in email security standards: SPF, DKIM, DMARC, ARC, and TLS transport configurations.
• Strong understanding of hybrid identity systems: Microsoft Entra ID, Entra Connect, Password Hash Sync (PHS), Passthrough Authentication (PTA), and ADFS.
• Hands-on mastery of Microsoft Defender for Office 365 and Microsoft Purview (DLP, eDiscovery, Compliance).
• Demonstrated ability to communicate complex technical concepts clearly to technical and non-technical audiences.
• Strong collaboration and relationship-building skills, with experience partnering across diverse stakeholder groups, including security, legal, compliance, vendors, and business units.
• Excellent analytical, problem-solving, and decision-making abilities, particularly in high-pressure or service-impacting situations.
• Proven ability to prioritize multiple responsibilities, manage competing demands, and work independently with minimal supervision.
• Experience developing documentation, procedures, and training materials to support operational consistency and knowledge sharing.
• Strong customer service orientation and commitment to delivering reliable, user-focused technology services.
• Ability to lead initiatives, influence outcomes, and provide technical guidance and mentorship to colleagues and support teams.
• Demonstrated commitment to confidentiality, professionalism, and responsible stewardship of institutional data and resources.
• Willingness and ability to participate in after-hours support activities during critical incidents, maintenance windows, or service outages.
• Ability to cultivate and develop inclusive working relationships with students, faculty, staff, and community members.

Nice To Haves

• Working knowledge of Google Workspace administration, including Gmail configuration, email routing, user provisioning, compliance settings, and end-user support within an enterprise environment.
• Microsoft Certified: Enterprise Administrator Expert (formerly MS-100/MS-101 path)
• Microsoft Certified: Messaging Administrator Associate (Legacy MS-203)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• Proficiency in C# and the .NET ecosystem
• Prior use of Kuali Financial System (KFS), PCR-360, OAS/Answers, TDX and Quickbooks preferred.

Responsibilities

• Design, maintain, and optimize enterprise messaging architecture, including Exchange Online environments and Exchange hybrid servers, in partnership with platform, identity, security, and infrastructure teams.
• Lead complex messaging migrations, including tenant-to-tenant consolidations and legacy system cutovers using native Microsoft tools and approved third-party solutions.
• Manage hybrid coexistence, ensuring smooth cross-premises mail flow, OAuth authentication, free/busy calendar lookups, and Hybrid Configuration Wizard (HCW) maintenance.
• Architect end-to-end mail routing, managing inbound/outbound connectors, transport rules, smart hosts, and internal SMTP relays.
• Support domain security and deliverability by maintaining configurations for SPF, DKIM, DMARC, ARC, and BIMI across Cornell-managed domains.
• Diagnose critical mail flow issues, performing deep-packet and header analysis, message traces, and resolving severe delivery failures or sender reputation blocks.
• Build and maintain automation scripts using Exchange Online PowerShell (V3) and Microsoft Graph API for user lifecycle management, reporting, and bulk administrative tasks.
• Integrate identity workflows with Microsoft Entra ID (formerly Azure AD), Entra Connect/Cloud Sync, and hybrid Active Directory environments.
• Engineer Defender for Office 365 protection, fine-tuning anti-phishing, anti-spam, Safe Links, Safe Attachments, and Zero-Hour Auto Purge (ZAP) policies.
• Collaborate with Security, Legal, Compliance, and service teams to support Microsoft Purview capabilities, including Data Loss Prevention rules, retention policies, sensitivity labels, litigation holds, and eDiscovery processes.
• Establish governance and access control, maintaining Role-Based Access Control (RBAC) frameworks and Privileged Identity Management (PIM) for messaging services.
• Serve as the final escalation point for complex messaging disruptions, Outlook client connectivity failures (Modern Auth, Autodiscover), and service outages.
• Perform Root Cause Analysis (RCA) following major incidents and drive long-term systemic remediation.
• Author technical documentation, architecture diagrams, and Standard Operating Procedures (SOPs) for lower-tier administration teams.
• Foster a culture of belonging and a healthy work environment by communicating across differences; being cooperative, collaborative, open, and welcoming; showing respect, compassion, and empathy; engaging and supporting others regardless of background or perspective; speaking up when others are being excluded or treated inappropriately; and supporting work/life integration of oneself and others.
• Respond and resolve system outages that occur nights, weekends, and/or holidays.

Benefits

• Generous retirement contributions
• Educational benefits
• Comprehensive health care options
• Access to a plethora of wellness programs
• Employee discounts with local and national retail brands
• Three weeks of vacation
• Two floating holidays
• 13 holidays: Martin Luther King, Jr. Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Thanksgiving and the day after, and an end of the year winter break from December 25-January 1.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior