GCC High M365 Cloud Engineer | Azure & Security Platform

Proven IT; Tinley Park (IL); On-site; USD 140,000 - 220,000; Full time

Benefits offered by this job

Health insurance

Life Insurance

Long-Term Disability (LTD)

401K plan

Parental leave

On-site fitness center

Job summary

Atom Security is seeking an experienced engineer to lead end-to-end GCC High and Azure Commercial infrastructure delivery, from tenant provisioning to security toolchains and legacy tool migration. The role covers dual tracks for DIB clients and broader MSSP services, with a clear growth path toward platform ownership or client-facing advisory work.

The candidate will implement MFA, PIM, Lighthouse, and Defender XDR across GCC High and Commercial tenants, ensuring compliant go-live and scalable

Qualifications

• GCC High: hands-on tenant provisioning and administration; Azure Commercial equivalents do not qualify.
• Microsoft Sentinel: MSSP workspace architecture, cross-workspace KQL, Lighthouse-delegated RBAC, analytics rule configuration
• Azure Virtual Desktop: deployment and administration in Azure Government
• Microsoft Intune (GCC High): device enrollment, Compliance policies, CA integration
• Entra ID Governance: PIM, CA, Named Locations, Identity Protection
• Microsoft Lighthouse: multi-tenant delegation configuration and RBAC scoping for MSSP management
• Azure Arc: server and hybrid endpoint onboarding and management
• SharePoint GCC High: site architecture, permissions model, and document library structure
• Azure Key Vault: provisioning, access policy configuration, and secrets management

Responsibilities

• Provision Atom’s GCC High Operations Tenant through an AOS-G authorized partner and build the parallel Azure Commercial Operations Tenant as isolated sovereign tracks
• Establish Entra ID baseline across both tenants: admin account structure, security group naming conventions, and identity governance configuration
• Deploy Azure Virtual Desktop host pool in Azure Government for SOC analyst and vCISO secure access
• Configure Microsoft Lighthouse delegation framework across both tracks to support multi-client MSSP management
• Implement MFA and Conditional Access policies across all administrative accounts on both tenants
• Configure Privileged Identity Management (PIM) for all privileged roles across both tenants
• Enroll all analyst devices, vCISO devices, and AVD session hosts into GCC High and Commercial Intune respectively
• Document the separate Entra identity model (distinct UPNs per track) as a formal access control artifact
• Stand up Microsoft Sentinel MSSP workspaces on both tracks with baseline analytics rules, alert routing, and cross-workspace KQL queries
• Apply Defender XDR P2 baseline policy across the GCC High tenant
• Deploy CrowdStrike Gov endpoint agents to CMMC client environments; deploy CrowdStrike Commercial Falcon for non-CMMC clients
• Activate Azure Arc and Intune management on Atom operations devices
• Verify track separation end-to-end and reflect findings in finalized network diagrams
• Go-Live readiness: support SSP completion and client onboarding post-launch
• As practice scales, participate in client-facing technical work including vCISO support and security architecture reviews

Skills

GCC High experience

Tenant provisioning

Security engineering

Tools

Azure Government (GCC High)

Azure

Microsoft Sentinel

Intune GCC High

Entra ID

Lighthouse

Azure Arc

SharePoint GCC High

Azure Key Vault

CrowdStrike Gov

CrowdStrike Falcon

Job description

Atom Security is seeking an experienced engineer to lead end-to-end GCC High and Azure Commercial infrastructure delivery, from tenant provisioning to security toolchains and legacy tool migration. The role covers dual tracks for DIB clients and broader MSSP services, with a clear growth path toward platform ownership or client-facing advisory work.

The candidate will implement MFA, PIM, Lighthouse, and Defender XDR across GCC High and Commercial tenants, ensuring compliant go-live and scalable