Lead Engineer, Microsoft 365 and Identity Automation

flagshippioneeringinc; Cambridge; On-site; GBP 75,000 - 110,000; Full time

Job summary

Flagship Pioneering Inc. in Cambridge, UK is seeking a hands-on Lead Engineer to own the code and automation for the Microsoft 365 and Entra ID environment.

You will inherit existing code, extend it as identities and domains evolve, and serve as a senior escalation point when automation breaks. This role emphasizes engineering over management, with a focus on secure, scalable identity lifecycle across the portfolio.

Qualifications

• 6+ years of experience engineering and supporting Microsoft 365 and Entra ID environments.
• Advanced PowerShell experience, including the Microsoft Graph PowerShell SDK and Exchange Online PowerShell, with working proficiency in another scripting or programming language.
• Demonstrated experience inheriting, troubleshooting, refactoring, and supporting existing production codebases.
• Hands-on experience with Entra identity lifecycle management, groups and licensing, app registrations, service principals, Conditional Access, PIM, B2B identity,

Responsibilities

• Own and extend production automation using Graph, PowerShell, and APIs.
• Resolve defects and reduce technical debt while documenting solutions.
• Ensure secure, least-privilege automation with proper app registrations and service principals.
• Maintain Exchange Online and SharePoint Online automation for mailboxes and sites.
• Manage joiner/mover/leaver processes across Flagship and portfolio companies.
• Support Entra capabilities including lifecycle workflows and conditional access.
• Build integrations among HR, ITSM, identity, and collaboration systems, including Workato.
• Apply engineering best practices with Git, testing, CI/CD, and runbooks.
• Mentor peers and serve as senior escalation point for Microsoft 365 issues.

Skills

Microsoft 365

Entra ID

PowerShell

Microsoft Graph

Automation engineering

Git

API patterns

CI/CD

Troubleshooting

Tools

Exchange Online PowerShell

SharePoint Online

Workato

Microsoft Graph API

Graph SDKs

Job description

Position Summary

We are looking for a hands-on Lead Engineer to own the code and automation that runs our Microsoft 365 and Entra ID environment. Flagship operates a single, shared Microsoft 365 tenant that supports dozens of portfolio companies, each with its own identity, domain, and lifecycle needs. Much of how we provision, govern, and retire identities in that tenant is done through code: Microsoft Graph integrations, Exchange Online and SharePoint Online PowerShell, Python tooling, and integration platform workflows.

This is a hands-on individual contributor role focused on engineering, not architecture or people management. You will inherit existing code bases, keep them healthy, extend them as new identity sources and attributes become available, and make sure Entra lifecycle management keeps working as the business changes. You will also be a senior escalation point when automation or tenant behavior breaks.

What You Will Do

• Build, maintain, and extend production automation using Microsoft Graph, PowerShell, and supported APIs. Take ownership of existing scripts, integrations, and services by resolving defects, reducing technical debt, documenting solutions, and updating code as identity sources, attributes, domains, and organizational requirements change.
• Engineer secure and reliable automation using appropriate API patterns, monitoring, logging, error handling, and least-privilege authentication, including app registrations, service principals, managed identities, certificates, and properly scoped permissions.
• Maintain and improve Exchange Online and SharePoint Online automation for mailboxes, groups, permissions, domains, mail flow, site provisioning, sharing, and lifecycle management, including changes driven by portfolio company launches, mergers, renames, and other lifecycle events.
• Maintain accurate joiner, mover, and leaver processes for employees and contractors across Flagship and its portfolio companies, including provisioning, groups, licensing, access changes, and deprovisioning.
• Engineer and support Entra capabilities including Lifecycle Workflows, identity governance, dynamic groups, Privileged Identity Management, Conditional Access, B2B identity, single sign-on, and SCIM provisioning.
• Build and maintain integrations among HR, ITSM, identity, and collaboration systems using Microsoft Graph, native Microsoft capabilities, custom code, or integration platforms such as Workato when appropriate.
• Apply strong engineering practices through Git-based source control, peer review, testing, change control, monitoring, CI/CD, runbooks, and clear support documentation.
• Mentor peers and serve as a senior escalation point for complex Microsoft 365 and identity issues, with an emphasis on resolving root causes through code, configuration, or native platform capabilities.

Required Qualifications

• 6+ years of experience engineering and supporting Microsoft 365 and Entra ID environments, including 3+ years developing and maintaining production automation using Microsoft Graph.
• Advanced PowerShell experience, including the Microsoft Graph PowerShell SDK and Exchange Online PowerShell, with working proficiency in another scripting or programming language.
• Demonstrated experience inheriting, troubleshooting, refactoring, and supporting existing production codebases.
• Hands-on experience with Entra identity lifecycle management, groups and licensing, app registrations, service principals, Conditional Access, PIM, B2B identity,