M365 Engineer | Hybrid

Cloudstaff Philippines Inc.; Philippines; On-site; PHP 900,000 - 1,200,000; Full time

Benefits offered by this job

Employee Share Units program

Cloudstaff Dream Points

Health and life insurance

Career advancement

In-house psychiatrist

International career growth

Free Coffee, Meals and Beer Fridays

Mental Wellness EAP Lifeworks

Job summary

Cloudstaff Philippines Inc. in the Philippines is seeking a hands-on M365 Engineer to help build, migrate, and operate the Microsoft 365 and Entra Identity environment as Nexgen transitions from an MSP.

Early in the programme, the role builds familiarity with the new tenancy and helps develop IT operating procedures alongside the Principal M365 Consultant, then delivers the hands-on migration before moving into business-as-usual operation, hardening and support.

Qualifications

• Four or more years administering Microsoft 365 and Entra ID in production.
• Strong Entra ID experience: CA, MFA, SSO and PIM.
• Intune device management for Windows 11 and policy enforcement.
• Experience with endpoint protection and telemetry.
• Automation using PowerShell and Microsoft Graph.
• Operations of Dynamics 365: user onboarding, licensing, permissions.

Responsibilities

• Assist build and configuration of greenfield M365/Entra ID tenant with the Principal M365 Consultant.
• Migrate mailboxes, files, Power Platform and Power BI workloads to Nexgen tenant.
• Manage Entra ID for identity, SSO, MFA and PIM; implement strong security controls.
• Manage devices with Intune, apply CIS/ACS baselines and retire older devices.
• Operate Defender for Endpoint or CrowdStrike and app control; maintain coverage.
• Onboard non-SSO apps to Entra ID and roll out Purview labelling and DLP.
• Admin Dynamics 365 user onboarding, licensing, security roles and permissions.
• Develop IT runbooks and provide ongoing M365 administration and end-user support.

Skills

Microsoft 365 Admin

Azure Entra ID / Entra ID

Exchange Online

SharePoint Online

OneDrive

Microsoft Teams

Intune

Defender for Endpoint / CrowdStrike

PIM / MFA / SSO

PowerShell / Microsoft Graph

Dynamics 365 administration

Power Platform governance

Identity and access management

Education

Microsoft certifications: MS-102 / SC-300 / MD-102

Power Platform / Dynamics 365 admin certs (PL-200 / MB-910)

Relevant tertiary qualification or equivalent experience

Job description

Job Description

The Microsoft 365 (M365) Engineer is a hands-on engineering role that helps build, migrate, and operate the Microsoft 365 and Microsoft Entra ID environment as Nexgen transitions off its incumbent managed service provider into its own dedicated tenant.
Early in the programme, the role builds familiarity with the new tenancy and helps develop the IT operatingprocedures alongside the Principal M365 Consultant, then delivers the hands-on migration before moving into business-as-usual operation, hardening and support.
Because the team is small, the role is deliberately broad and helps cover the parallel security and platform functions, including administration of the Nexgen Microsoft Dynamics 365 environment, alongside its primary Microsoft discipline.

Key Responsibilities:

• Support the build and configuration of the greenfield Microsoft 365 and Microsoft Entra ID tenant withthe Principal M365 Consultant, covering Exchange Online, SharePoint Online, OneDrive, Microsoft Teams, Microsoft Intune and Microsoft Defender.
• Plan and execute the migration of mailboxes, files, collaboration content, Power Platform and Power BI workloads off the incumbent tenant into the Nexgen tenant.
• Manage Microsoft Entra ID for identity, single sign-on (SSO) and Conditional Access, implement phishing-resistantmulti-factor authentication (MFA), and run Privileged Identity Management (PIM) using Microsoft Entra ID P2 add-on licensing.
• Manage the fleet as Microsoft Entra ID joined and Microsoft Intune managed, retiring remaining Windows 10 devices and enrolling workstations into the Nexgen tenant, applying Centre for Internet Security (CIS) and ACSC Essentials hardening baselines.
• Operate the endpoint protection platform (Microsoft Defender for Endpoint or CrowdStrike) and application control, restoring devices to full reporting coverage.
• Onboard remaining non-single sign-on applications to Microsoft Entra ID and roll out Microsoft Purview sensitivity labelling and Data Loss Prevention (DLP) across Microsoft 365.
• Provide day-to-day administration of Microsoft Dynamics 365, including user onboarding and licence assignment, security roles, security groups, and record and field-level permissions (administrative configuration and access management, not Dynamics development or customisation).
• Develop and maintain IT operations runbooks for the new environment, and provide day-to-day Microsoft 365 administration and end-user support after migration.

Parallel and Cross-Functional Responsibilities:

• Produce evidenced Essential Eight (Level 1) and Centre for Internet Security (CIS) self-assessments for the endpoint fleet.
• Deliver backup and disaster recovery independence for Microsoft 365, covering tenant configuration through Desired State Configuration (DSC) and immutable data backups.
• Administer the Power Platform, applying data loss prevention and tenant isolation to Power Apps, Power Automate and Power BI workspaces.
• Provide endpoint and identity telemetry to the Security Operations Engineer and the Security Operations Centre (SOC) to support detection and response.

Technical Environment:

• Microsoft 365 (E3 licensing with add-ons), Microsoft Entra ID with P2 for PIM, and Microsoft Intune for device management.
• Microsoft Defender for Endpoint or CrowdStrike for endpoint protection, with application control asthe incumbent whitelisting tool.
• Microsoft Purview for classification, labelling and data loss prevention, and Microsoft 365 Desired State Configuration for tenant configuration management.
• Microsoft Dynamics 365 line of business applications, administered through the Power Platform admin centre, with access and permissions managed via Microsoft Entra ID security groups and Dynamics 365 security roles.
• Cloud-only Microsoft Entra ID hardened to the Australian Signals Directorate (ASD) Blueprint for Secure Cloud, feeding endpoint and identity telemetry to the Nexgen Security Information and Event Management (SIEM) platform.

Qualifications and Requirements

Required Skills and Experience:

• Four or more years administering Microsoft 365 and Microsoft Entra ID (Azure AD), including Exchange Online, SharePoint Online, OneDrive and Microsoft Teams in a production environment.
• Strong Microsoft Entra ID experience covering Conditional Access, Multi-Factor Authentication (MFA), SSO and Privileged Identity Management.
• Practical Microsoft Intune experience enrolling and managing Microsoft Entra ID joined Windows 11 devices with compliance and configuration policies.
• Experience operating an endpoint protection platform and application control, and supporting endpoint telemetry.
• Scripting and automation with PowerShell and the Microsoft Graph.
• Experience administering Microsoft Dynamics 365 from an operational standpoint, covering user onboarding, licensing, security roles, security groups and permissions (rather than as a Dynamics developer or customiser).
• Working knowledge of the Essential Eight and CIS baselines, Microsoft 365 backup and migration between tenants.

Highly Desirable:

• Experience hardening tenants to the ASD Blueprint for Secure Cloud and evidencing Essential Eight maturity.
• Tenant-to-tenant migration experience, including mail and file migration and the associated tooling.
• Power Platform administration experience covering Power Apps, Power Automate and Power BI governance.
• Exposure to Amazon Web Services (AWS) and hybrid identity, and ITIL or equivalent service management experience.

Qualifications:

• Relevant Microsoft certifications such as MS-102 (Microsoft 365 Administrator), SC-300 (Identity and Access Administrator) or MD-102 (Endpoint Administrator), or equivalent experience.
• Microsoft certification in Dynamics 365 or Power Platform administration (for example PL-200 or MB910) is an advantage but not essential.
• A relevant tertiary qualification or equivalent experience.

Ways of Working:

• Work as part of a small, distributed team, taking broad ownership and covering adjacent roles when needed, collaborating closely with the vCISO, Security Operations Engineer and SOC Analyst.
• Maintain clear as-built documentation and configuration records so the Nexgen platform stays supportable after transition.

Perks and Benefits

• Become part of the Employee Share Units program
• Cloudstaff Dream Points - To be used for bidding useful items like appliances, kitchenettes etc.
• Comprehensive health and life insurance on your 16th day of employment, covering 1 free dependent on the 16th day of employment
• Endless opportunities for career advancement
• In-house psychiatrist available to support employees' well-being
• International career growth and connections
• Look forward to weekly office perks for work-from-office staff – Free Coffee, Meals and Beer Fridays!
• Mental Wellness Employee Assistance program through Lifeworks