IT Operations Principal (M365 Engineer)

Cornerstone Building Brands; Cary (NC); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Remote-first environment

Full benefits from day 1

PTO and holidays

Tuition reimbursement

Professional development

Job summary

Cornerstone Building Brands seeks an experienced Microsoft 365 engineer to own and optimize Exchange Online, Entra ID, Teams, and Copilot ecosystems. The role focuses on automating toil, reducing tickets, and enabling self-service across the organization.

You will work remotely with teams across IT and the business, maintain security and reliability, and contribute to measurable business value through improved efficiency, lower risk, and cost avoidance, while following best-practice change

Qualifications

• 3–5 years of M365 in production
• PowerShell scripting experience
• Experience with Microsoft Graph
• Experience with Copilot or self-service automation is a plus
• Strong documentation skills

Responsibilities

• Automate the toil away
• Kill the repeat tickets - when the same request shows up for the third time, you automate and fix the root cause
• Build self-service - access requests and group management
• Measure what you removed - track tickets that stop happening
• Get Copilot ready - privacy, labeling, and security hygiene

Skills

M365 administration

PowerShell scripting

Microsoft Graph

Self-service automation

Security & compliance

Documentation writing

Education

Bachelor's degree in Computer Science or related field

Tools

Power Automate

PowerShell

Microsoft Graph

Logic Apps

Copilot Studio

Graph connectors

Bicep

Terraform

Azure Automation

Job description

Job Description

Most Microsoft 365 jobs are about keeping the lights on. This one is about turning the lights off - on the manual work, at least. We are looking for an engineer who treats every repetitive ticket as a bug in the system, and who works with the team to fix the system.

You will share ownership of the platform our company works in every day - Exchange, Entra ID, Teams, and increasingly Microsoft 365 Copilot - alongside the rest of Technology Operations. Keeping it healthy is the baseline. The actual job is making it require less human intervention each quarter than it did the last - through automation, better defaults, and self‑service that people genuinely prefer over opening a ticket.

This role suits someone who genuinely enjoys IT operations and the Microsoft platform, and who wants to spend their time working across the business - with security, compliance, the service desk, and the teams we support - to make the organization more efficient and better prepared. The measure of success here is business value: hours given back to the people we support, risk reduced, and costs avoided - delivered with a service mindset that treats every colleague as a customer whose time matters.

What You'll Actually Do

Automate the toil away

• Kill the repeat tickets - when the same request shows up for the third time, you and the service desk decide it is worth automating, and you build the fix instead of closing tickets faster. Power Automate, PowerShell, Microsoft Graph, Logic Apps - whatever fits.
• Build self‑service - access requests, group management, and common fixes that users can resolve without waiting on IT.
• Measure what you removed - we care about the tickets that stopped happening, not the ones you closed quickly.
• Get Copilot ready - permissions hygiene, oversharing remediation, and sensitivity labeling with security and compliance, then agents and pilots where a team has a real problem worth solving.

Treat the tenant like a platform

• Configuration as code - tenant changes should live in version control and go through peer review, not in someone's memory of what they clicked.
• Ship changes safely - test, roll out deliberately, and be able to roll back. Change management as engineering practice, not paperwork.
• Documentation and roadmap - runbooks and notes people actually trust.

Keep the core solid

The forward‑looking work only earns trust if the fundamentals hold, and the people we support feel well served day by day. A meaningful share of the role is still hands‑on operations:

• Exchange Online and Entra ID operations - mail flow, connectors, transport rules, and email authentication (SPF, DKIM, DMARC); Conditional Access, MFA and passwordless rollouts, SSO integrations, directory sync, and privileged access.
• Tier‑3 escalation for M365 issues - root cause analysis that produces a permanent fix - plus a shared on‑call rotation and occasional maintenance windows.

Qualifications

We care more about how you think than about the exact boxes you tick. If you meet most of this and are genuinely interested in the rest, apply.

• You've run M365 in production - roughly 3‑5 years administering a real tenant with real users, including Exchange Online and Entra ID.
• You script by default - PowerShell is your reflex, and you have used Microsoft Graph to do things the admin portals cannot.
• You debug to root cause - authentication failures, mail delivery problems, and sync errors get investigated - and what you find gets written up and shared, not just restarted.
• You're already curious about Copilot - whether through hands‑on admin work, building agents, or serious self‑directed learning.
• You write well - clear documentation and plain‑language explanations for non‑technical colleagues. This matters more on a remote team.
• You work well with others - comfortable partnering across IT and the business, strong at asynchronous communication, and calm when something breaks at an inconvenient hour.
• You lead with service - you treat colleagues as customers, communicate clearly while an issue is open, follow through past the point where the ticket closes, and use what you hear from them to decide what to fix next.
• You connect work to outcomes - you can explain what a project saves, prevents, or enables in terms the business recognizes, and you prioritize accordingly.

Bonus Points

• Hands‑on work with Copilot Studio, declarative agents, or Graph connectors.
• Infrastructure‑as‑code experience (Bicep, Terraform, Azure Automation) or CI/CD applied to tenant configuration.
• Defender for Office 365 or Defender for Identity.
• Hybrid Exchange or migration experience, including tenant‑to‑tenant moves.
• Certifications such as MS‑102, SC‑300, or AZ‑104 - useful signal, not a requirement.
• Experience in a regulated environment with formal audit requirements.

Working Here

• Fully remote, with a preference for candidates in the Eastern or Central time zone so there is real overlap with the team.
• Less than 25% travel for occasional team meetings and site visits.
• On‑call rotation shared across the team - nobody carries it alone.
• Education: a degree in a technical field is welcome, and equivalent hands‑on experience is equally welcome.

Additional Information

Why work for Cornerstone Building Brands?

Our teams are at the heart of our purpose to positively contribute to the communities where we live, work and play. Full‑time* team members receive** medical, dental and vision benefits starting day 1. Other benefits include PTO, paid holidays, FSA, life insurance, LTD, STD, 401k, EAP, discount programs, tuition reimbursement, training, and professional development.

*Full‑time is defined as regularly working 30+ hours per week.**Union programs may vary depending on the collective bargaining agreement.

All your information will be kept confidential according to EEO guidelines.

Note: Disclosure as required by sb19-085 (8-5-20), sb293 (BDR 53-907), and NYCHRL salary (or hourly wage) compensation for this role when being hired into our Colorado or Nevada office or as a remote or virtual Colorado, Nevada, or New York City based employee.

Cornerstone Building Brands is an Equal Opportunity Employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, or status as a protected veteran. You can find the Equal Employment Opportunity Poster here. You can also view Your Right to Work Poster herealong with This Organizations Participation in E‑Verify Poster here.

California Consumer Privacy Act (CCPA) of 2018

Must be at least 18 years of age to apply.