Senior Microsoft 365 Engineer

WellStreet Urgent Care • Atlanta, GA

4d

About The Position

We’re hiring the engineer who’ll own the Microsoft 365 platform at WellStreet, in an environment where identity and data governance are HIPAA obligations and not checkboxes. The governance you put in place is what we’ll run on, and how it gets managed is yours to define. This job has depth, autonomy and a lot of engineering in it, but the depth runs toward M365 and not toward Azure. Today this tenant is managed largely by clicking in admin centers. That’s what we’re hiring you to change. We’re building toward version-controlled, API-driven management in an Azure DevOps repo, with Graph and PowerShell as the primary instruments, app-only auth and Key Vault instead of interactive logins, and Python or declarative tooling where they earn their place. We have no illusions about how far that goes, since parts of the M365 surface have solid config-as-code coverage today and parts don’t. What we’re after is that opening a portal becomes a deliberate exception. We’re not asking for prior GitOps-on-M365 experience. That market barely exists and the tooling is mid-shift. We’re asking for the instinct and the judgment; the specific tooling we’ll work out together. We use AI heavily across engineering, administration and documentation, and we expect fluency with it, including a clear sense of what has to be reviewed before it touches a tenant holding PHI.

Requirements

• Five or more years in M365, identity, or security engineering, with tenant-level depth in Entra ID and Intune.
• Real Purview configuration experience: writing DLP policies, labeling, retention, eDiscovery.
• Microsoft Graph and PowerShell fluency.
• Proficiency with version control, with branches and pull requests as normal practice.
• Experience working against a regulated framework (HIPAA, HITRUST, SOC 2, or PCI) and ability to explain a control.
• Daily use of AI, with understanding of where to trust it and where to check it.

Nice To Haves

• Terraform, Bicep, or Azure DevOps pipelines.
• Declarative M365 management experience (Microsoft365DSC, Terraform M365 provider, Graph Tenant Configuration Management APIs).
• Healthcare IT experience.
• Experience owning a vulnerability or patch compliance program.
• Experience with FreshService or a comparable ITSM.
• ITIL v4 certification.
• Relevant Microsoft certifications (SC-200, SC-300, SC-400, MS-102, MD-102).

Responsibilities

• Design the sensitivity label taxonomy and DLP policies across Exchange, SharePoint, and Teams.
• Implement and manage Single Sign-On (SSO) and SCIM for clinical vendors, including deprovisioning.
• Automate access reviews for privileged groups using Graph scripts.
• Triage and manage critical CVEs from SecOps.
• Transition Intune configurations from admin centers to version-controlled repositories.
• Manage Entra ID tenant architecture, Conditional Access, hybrid identity, privileged access, password protection, SSPR, and access reviews.
• Configure Intune across Windows, macOS, iOS, and Android, including compliance and configuration profiles, security baselines, Autopilot, update rings, and app packaging.
• Configure Exchange Online, Teams, and SharePoint, including mail flow and transport rules.
• Configure Purview for DLP, sensitivity labeling, retention, audit, eDiscovery, and map to HIPAA and HITRUST controls.
• Manage SSO and SCIM for enterprise applications, ensuring no app touching PHI runs on standalone credentials.
• Implement and manage Defender for endpoint detection and response, Defender for Office 365 anti-phishing and threat investigation, and unified alert views.
• Manage vulnerability response, including CVE triage, remediation tracking, and reporting.
• Maintain an accurate catalog of the application portfolio, ensure runbooks are functional, and hold vendors accountable to SLAs and BAAs.

Benefits

• Real platform ownership with the mandate and backing to build an engineering practice.
• Opportunity to set standards as the first dedicated hire for this function.
• Potential to lead as more engineers are added.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed