Cloud Engineer

Symmetric Headhunting; Greater Lincolnshire; On-site; GBP 90,000 - 120,000; Full time

Job summary

Symmetric Headhunting is seeking a hands‑on cloud‑first engineer to secure and optimise Microsoft 365 and Azure in production. You will own tenant configuration, hardening and continual improvement, acting as the senior escalation point for complex cloud and identity issues.

Your work will emphasise Conditional Access, Defender, Sentinel, and automation with PowerShell and IaC, setting standards for platform operations and governance.

Qualifications

• Demonstrable experience configuring and securing Microsoft 365 and Azure in production, not first‑line support exposure.
• Deep expertise in Microsoft Entra ID, Conditional Access and identity and access management.
• Hands‑on with Defender, Sentinel, Purview, Intune or similar security tooling.
• Strong PowerShell skills and automation, ideally with Graph API.
• Proven cloud governance, tenant hardening and operational best practices.
• Clear communicator with both technical and non‑technical stakeholders.

Responsibilities

• Configure, secure and optimise Microsoft 365 services across Exchange Online, Teams, SharePoint Online and OneDrive.
• Harden Azure infrastructure with a security‑first approach throughout.
• Own identity and access design and enforcement for Entra ID, Conditional Access and MFA.
• Implement and manage Defender, Sentinel, Purview and data loss prevention, plus Intune endpoint management.
• Serve as senior escalation point for complex M365, Azure and identity incidents and drive permanent fixes.
• Build automation for provisioning and operations using PowerShell, Graph API and IaC.
• Own governance, tenant standards and configuration baselines, champion FinOps for cost visibility.
• Lead migrations, upgrades and deployments with the security team to stay within controls.
• Provide technical leadership and mentoring to Cloud Engineers and shape the cloud roadmap.

Skills

Microsoft 365

Azure

PowerShell

Identity & Access Management

Automation

Security governance

Communication

Leadership

Tools

Graph API

Terraform

Bicep

Defender for Endpoint

Sentinel

Intune

Purview

Job description

This is a hands-on, cloud-first engineering role for someone who builds and secures Microsoft 365 and Azure, rather than someone who supports it from a service desk. You will own the configuration, hardening and continual improvement of our tenant, act as the senior escalation point for complex cloud and identity issues, and set the standard for how our platforms are run.

If your strongest work is configuring Conditional Access policies, deploying and tuning Microsoft Defender, standing up Sentinel, automating with PowerShell and Infrastructure as Code, and driving Secure Score in the right direction, this role is built for you.

What you will do

• Configure, secure and optimise Microsoft 365 services across Exchange Online, Teams, SharePoint Online and OneDrive.
• Administer and harden Azure infrastructure, with a security-first approach throughout.
• Own identity and access: Microsoft Entra ID, Conditional Access, and MFA policy design and enforcement.
• Implement and manage Microsoft security tooling: Defender for Endpoint, Defender for Office 365, Purview and data loss prevention, and Intune endpoint management.
• Act as the senior escalation point for complex M365, Azure and identity incidents, leading root cause investigation and permanent fixes.
• Build automation for provisioning, configuration and operations using PowerShell, Graph API and Infrastructure as Code.
• Own governance, tenant standards and configuration baselines, and champion FinOps for cost visibility and efficiency.
• Lead M365 and Azure migrations, upgrades and deployments, working closely with our Network and Cyber Security Engineers to keep everything inside our security controls.
• Provide technical leadership and mentoring to Cloud Engineers, and shape the cloud roadmap.

What we need from you

• Demonstrable experience configuring and securing Microsoft 365 and Azure in production, not first-line support exposure.
• Real depth in Microsoft Entra ID, Conditional Access and identity and access management.
• Hands-on experience with Microsoft security tooling such as Defender, Sentinel, Purview or Intune.
• Strong PowerShell scripting and automation, ideally with Graph API.
• A track record of cloud governance, tenant hardening and operational best practice.
• Sound judgement under pressure, and clear communication with technical and non-technical stakeholders.

Nice to have

• Microsoft certifications such as SC-200, SC-300, SC-100, AZ-500, AZ-104, MS-102 or MS-500.
• Infrastructure as Code with Bicep or Terraform.
• FinOps and cloud financial management.
• Experience in an ITIL service management environment.