Lead Engineer, Microsoft 365 and Identity Automation

Flagship Pioneering is a biotechnology company that invents and builds platform companies that change the world. We bring together the greatest scientific minds with entrepreneurial company builders and assemble capital to allow them to take courageous leaps. Those big leaps in human health and sustainability exponentially accelerate scientific progress in areas ranging from cancer detection and treatment to nature-positive agriculture. What sets Flagship apart is our ability to advance biotechnology by uniting life science innovation, company creation, and capital investment under one roof in a way that is largely without precedent. Our scientific founders, entrepreneurial leaders, and professional capital managers are each aligned around an institutionalized process that enables us to innovate and transform for the benefit of people and planet. Many of the companies Flagship has founded have addressed humanity’s most urgent challenges: vaccinating billions of people against COVID-19, curing intractable diseases, improving human health, preempting illness, and feeding the world by improving the resiliency and sustainability of agriculture. Flagship has been recognized twice on FORTUNE’s “Change the World” list, an annual ranking of companies that have made a positive social and environmental impact through activities that are part of their core business strategies and has been twice named to Fast Company’s annual list of the World’s Most Innovative Companies.Position SummaryWe are looking for a hands-on Lead Engineer to own the code and automation that runs our Microsoft 365 and Entra ID environment. Flagship operates a single, shared Microsoft 365 tenant that supports dozens of portfolio companies, each with its own identity, domain, and lifecycle needs. Much of how we provision, govern, and retire identities in that tenant is done through code: Microsoft Graph integrations, Exchange Online and SharePoint Online PowerShell, Python tooling, and integration platform workflows. This is a hands-on individual contributor role focused on engineering, not architecture or people management. You will inherit existing code bases, keep them healthy, extend them as new identity sources and attributes become available, and make sure Entra lifecycle management keeps working as the business changes. You will also be a senior escalation point when automation or tenant behavior breaks. What You Will Do Build, maintain, and extend production automation using Microsoft Graph, PowerShell, and supported APIs. Take ownership of existing scripts, integrations, and services by resolving defects, reducing technical debt, documenting solutions, and updating code as identity sources, attributes, domains, and organizational requirements change. Engineer secure and reliable automation using appropriate API patterns, monitoring, logging, error handling, and least-privilege authentication, including app registrations, service principals, managed identities, certificates, and properly scoped permissions. Maintain and improve Exchange Online and SharePoint Online automation for mailboxes, groups, permissions, domains, mail flow, site provisioning, sharing, and lifecycle management, including changes driven by portfolio company launches, mergers, renames, and other lifecycle events. Maintain accurate joiner, mover, and leaver processes for employees and contractors across Flagship and its portfolio companies, including provisioning, groups, licensing, access changes, and deprovisioning. Engineer and support Entra capabilities including Lifecycle Workflows, identity governance, dynamic groups, Privileged Identity Management, Conditional Access, B2B identity, single sign-on, and SCIM provisioning. Build and maintain integrations among HR, ITSM, identity, and collaboration systems using Microsoft Graph, native Microsoft capabilities, custom code, or integration platforms such as Workato when appropriate. Apply strong engineering practices through Git-based source control, peer review, testing, change control, monitoring, CI/CD, runbooks, and clear support documentation. Mentor peers and serve as a senior escalation point for complex Microsoft 365 and identity issues, with an emphasis on resolving root causes through code, configuration, or native platform capabilities. Required Qualifications 6+ years of experience engineering and supporting Microsoft 365 and Entra ID environments, including 3+ years developing and maintaining production automation using Microsoft Graph. Advanced PowerShell experience, including the Microsoft Graph PowerShell SDK and Exchange Online PowerShell, with working proficiency in another scripting or programming language. Demonstrated experience inheriting, troubleshooting, refactoring, and supporting existing production codebases. Hands-on experience with Entra identity lifecycle management, groups and licensing, app registrations, service principals, Conditional Access, PIM, B2B identity, SSO, and SCIM provisioning. Experience automating Exchange Online administration and working with SharePoint Online administration or automation. Working knowledge of REST APIs, OAuth 2.0, JSON, Git-based workflows, code review, testing, monitoring, and unattended authentication. Broad Microsoft 365 operational knowledge, including the ability to troubleshoot complex issues across Entra ID, Exchange Online, Intune, SharePoint, and Teams. Strong problem-solving, documentation, and communication skills, with the ability to lead technical work and explain tradeoffs to technical and nontechnical stakeholders. Preferred Qualifications Experience with Workato or a comparable integration platform such as Power Automate, Azure Logic Apps, MuleSoft, or Boomi, or demonstrated ability to work effectively with integration and low-code automation platforms. Experience with Entra ID Governance, HR-driven identity integration, or multi-company and multi-domain Microsoft 365 environments. Experience supporting company launches, mergers, divestitures, tenant transitions, or other complex organizational lifecycle events. Experience with Azure Automation, Azure Functions, Key Vault, CI/CD pipelines, infrastructure as code, or configuration as code. Experience with CoreView, ShareGate, or comparable Microsoft 365 administration, migration, and governance tools. Experience in regulated environments such as life sciences, GxP, or HIPAA. Relevant certifications such as SC-300, MS-102, AZ-104, or AZ-500. What Success Looks Like Existing automation is documented, monitored, maintained in source control, and supportable by others. Identity lifecycle processes operate reliably with minimal manual intervention and can absorb new data and organizational changes without manual workarounds. Automation follows least-privilege, credential-management, peer-review, testing, and change-control practices. Flagship Pioneering and our ecosystem companies are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status.At Flagship, we recognize there is no perfect candidate. If you have some of the experience listed above but not all, please apply anyway. Experience comes in many forms, skills are transferable, and passion goes a long way. We are dedicated to building diverse and inclusive teams and look forward to learning more about your unique background.Recruitment & Staffing Agencies: Flagship Pioneering and its affiliated Flagship Lab companies (collectively, “FSP”) do not accept unsolicited resumes from any source other than candidates. The submission of unsolicited resumes by recruitment or staffing agencies to FSP or its employees is strictly prohibited unless contacted directly by Flagship Pioneering’s internal Talent Acquisition team. Any resume submitted by an agency in the absence of a signed agreement will automatically become the property of FSP, and FSP will not owe any referral or other fees with respect thereto#LI-NM1Privacy Notice for Applicants: When you apply for a role at Flagship Pioneering or one of its portfolio companies, we collect and use personal information you provide (such as your name, contact details, work history, and application materials) to evaluate your application, communicate with you, and comply with legal obligations. Your application data is processed through Greenhouse, our applicant tracking system, and may also be reviewed using AI-assisted screening tools. We do not sell your personal information. California residents have rights under the CCPA/CPRA including to know, delete, and opt out of the sharing of their personal information. If you are located in the EU or UK, we process your data under GDPR and you have rights to access, rectify, and erase your data. To exercise your rights or for questions, contact View email address on click.appcast.io. The salary range for this role is $128,000 - $176,000. Compensation for the role will depend on a number of factors, including a candidate's qualifications, skills, competencies, and experience. Flagship Pioneering currently offers healthcare coverage, annual incentive program, retirement benefits and a broad range of other benefits. Compensation and benefits information is based on Flagship Pioneering's good faith estimate as of the date of publication and may be modified in the future.Privacy Notice for Applicants: When you apply for a role at Flagship Pioneering or one of its portfolio companies, we collect and use personal information you provide (such as your name, contact details, work history, and application materials) to evaluate your application, communicate with you, and comply with legal obligations. Your application data is processed through Greenhouse, our applicant tracking system, and may also be reviewed using AI-assisted screening tools. We do not sell your personal information. California residents have rights under the CCPA/CPRA including to know, delete, and opt out of the sharing of their personal information. If you are located in the EU or UK, we process your data under GDPR and you have rights to access, rectify, and erase your data. To exercise your rights or for questions, contact View email address on click.appcast.io.