M365 Platform Engineer — Governance & Security Lead

Corewell Health Urgent Care; Atlanta (GA); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

None

Job summary

WellStreet Urgent Care is seeking an engineer to own the Microsoft 365 platform, focusing on identity, data governance, and HIPAA obligations. You’ll design taxonomy for sensitivity labels, implement DLP, SSO/SCIM, and enforce zero trust through Graph, PowerShell, and code-driven configurations.

You’ll work across Entra ID, Intune, Exchange Online, Teams, SharePoint, Purview, and Defender, building runbooks, version control, and API-driven management in Azure DevOps.

Qualifications

• Five+ years in M365, identity or security engineering with tenant-level depth in Entra ID and Intune.
• Real Purview configuration experience: writing DLP policies, labeling, retention, eDiscovery.
• Microsoft Graph and PowerShell fluency; automation against the API; Python a plus.
• Version control with branches and PRs as normal practice.
• Experience with regulated frameworks (HIPAA, HITRUST, SOC 2 or PCI).
• Daily use of AI with clear review boundaries for PHI-related tenants.

Responsibilities

• Design sensitivity label taxonomy and DLP policies across Exchange, SharePoint, and Teams.
• Implement SSO/SCIM for clinical vendors and ensure proper deprovisioning workflows.
• Manage privileged access reviews and security configurations via Graph scripts.
• Triage vulnerabilities and coordinate with SecOps to remediate and report.
• Maintain a catalog of applications and runbooks with vendor SLAs and BAAs.

Skills

Entra ID

Intune

Exchange Online

Teams

SharePoint

Purview

Defender

Graph API

PowerShell

Tools

Azure DevOps

Terraform

Bicep

Python

Git

Job description

WellStreet Urgent Care is seeking an engineer to own the Microsoft 365 platform, focusing on identity, data governance, and HIPAA obligations. You’ll design taxonomy for sensitivity labels, implement DLP, SSO/SCIM, and enforce zero trust through Graph, PowerShell, and code-driven configurations.

You’ll work across Entra ID, Intune, Exchange Online, Teams, SharePoint, Purview, and Defender, building runbooks, version control, and API-driven management in Azure DevOps.