M365 Security Engineer

Our federal IT client is looking for a senior engineer to own the security and compliance posture of a Microsoft 365 GCC environment supporting a federal agency. This role sits at the center of device, identity, and M365 security: you will protect Windows, macOS, and iOS/iPadOS endpoints, keep access to M365 services compliant and reliable, and lead fast engineering responses to vulnerabilities, outages, and operational risk.

Scroll down to find an indepth overview of this job, and what is expected of candidates Make an application by clicking on the Apply button.

What You Will Do

• Engineer, test, and deploy Intune configuration and compliance policies across Windows, macOS, and iOS/iPadOS, including Enrollment Status Pages and OOBE workflows
• Design and validate device compliance based Conditional Access policies in Entra ID, and troubleshoot CAP failures, identity anomalies, and B2B guest access issues
• Lead integration and tuning of Microsoft Defender (XDR, Endpoint, Cloud Apps) and Microsoft Sentinel, including analytic rules, alert logic, audit retention, and connectors
• Build SIEM ingestion pipelines for third party log sources using Azure Function Apps and Log Analytics
• Write PowerShell remediation scripts to close compliance gaps, deploy CVE fixes, and enforce security baselines (for example NTLM disablement)
• Own data protection governance in Microsoft Purview: classification, sensitivity labeling, retention, and DLP
• Secure Exchange Online mail flow, encryption (S/MIME and/or MIP), and anti spam, anti phishing, and anti malware protections
• Support ATO and control assessments by drafting implementation statements and assembling evidence packages
• Provide Tier 3 support on device compliance, identity, telemetry, and app protection incidents, and coordinate enterprise rollout of urgent vulnerability mitigations
• Partner with Cyber, Ops, Enterprise Architecture, ICAM, and Comms teams, and keep Jira, Confluence, and change requests current

Required

• Bachelor's degree and 8+ years of experience, or 12+ years of experience in lieu of a degree
• US Citizen or US based person able to obtain a Public Trust (Level 5)
• Deep, hands on experience with Microsoft Defender (XDR, Endpoint, Cloud Apps)
• Hands on Microsoft Sentinel SIEM experience, including cross platform telemetry pipelines
• Expert level Intune engineering across Windows, macOS, and iOS/iPadOS xhyhwjd
• Advanced PowerShell for remediation, automation, and OS image manipulation
• Strong understanding of Conditional Access architecture and identity risk enforcement in Entra ID
• Experience producing ATO control evidence, compliance mapping, and audit support
• Clear communicator who can summarize technical issues in terms of user impact and stay steady during high severity events

Preferred

• Federal, high compliance, or high assurance environment experience (GCC or GCC High a strong plus)
• Jamf, Okta connectors, Copilot audit logging, and Microsoft Graph API operations
• macOS security hardening and mSCP baseline engineering
• Prior ownership of an enterprise wide Conditional Access rollout