Microsoft Cloud Engineer

Two Five; Washington (District of Columbia); On-site; USD 120,000 - 155,000; Full time

Job summary

Two Five Solutions in Washington, DC seeks an engineer with 5+ years of hands-on Microsoft work to stand up new Microsoft 365 tenants (GCC High and Commercial) and Azure landing zones, Entra ID and Intune baselines, and tenant-to-tenant migrations.

You will also provide Tier 2/3 support across client environments, diagnose and resolve escalations, maintain configuration baselines, and produce runbooks and knowledge-base articles for the service desk and analysts.

Qualifications

• 5+ years of hands-on Microsoft work in managed services, systems engineering, or internal IT.
• Tenant buildout experience: stood up Microsoft 365 tenants and Azure environments from nothing.
• Entra ID: Conditional Access, MFA design, identity lifecycle, hybrid identity.
• Intune and Autopilot: device enrollment, configuration profiles, compliance policies.
• Exchange Online and Teams administration, including migrations.

Responsibilities

• Environment buildouts and migrations: new Microsoft 365 tenants in GCC High and Commercial, Azure landing zones, Entra ID and Intune baselines, migrations.
• Tier 2/3 support across client bases: diagnose, resolve, and document escalations.
• Standards and hardening: maintain configuration baselines, flag drift.
• Runbooks and documentation: create runbooks and knowledge-base articles.

Skills

Microsoft 365

Azure administration

Tenant buildout

Entra ID

Intune

Exchange Online

Teams administration

PowerShell/Graph API

Documentation

Escalations handling

Tools

PowerShell

Graph API

MS Certifications

Job description

Two Five Solutions runs managed IT, managed security, and CMMC 2.0 compliance programs for defense industrial base contractors and regulated commercial firms. Our client environments span Microsoft GCC High, Azure Government, and commercial Microsoft 365 and Azure — and we build them, migrate into them, and operate them end to end.

We need an engineer who can do both halves of that: stand up new environments — GCC High and commercial tenants, Azure landing zones, identity and endpoint baselines — and carry Tier 2/3 support across the client base once they're live. You will be a senior technical resource on the delivery team, working escalations the service desk can't close and running buildout projects with real delivery dates.

This is not a Tier 1 helpdesk role. Ticket intake and first response stay with our service desk; you take what escalates and you build what's new.

What you'll own

Environment buildouts and migrations (~40%). New Microsoft 365 tenants in GCC High and Commercial, Azure and Azure Government landing zones, Entra ID and Intune baselines, tenant-to-tenant migrations, and the integration of acquired companies' users, devices, and data. These are scoped, billable projects — you own the delivery.

Tier 2/3 support across the client base (~40%). Escalations from the service desk across Microsoft 365, Entra ID, Intune, Exchange Online, Defender, and Azure infrastructure — in both GCC High and commercial tenants. You diagnose, resolve, and document so the same issue doesn't escalate twice.

Standards and hardening (~10%). Keep client tenants aligned to our configuration baselines — Conditional Access, device compliance, endpoint hardening — and flag drift before it becomes a finding or an incident.

Runbooks and documentation (~10%). Every environment you build gets a runbook. Every escalation pattern you resolve gets a knowledge-base article the analyst tier can use.

What you need

• 5+ years of hands‑on Microsoft work — administering and engineering Microsoft 365 and Azure in a managed services, systems engineering, or internal IT role. This is the requirement; everything below describes what that experience should look like.
• Tenant buildout experience: you have stood up Microsoft 365 tenants and Azure environments from nothing, not just administered ones someone else built
• Entra ID: Conditional Access, MFA design, identity lifecycle, hybrid identity with Entra Connect
• Intune and Autopilot: device enrollment, configuration profiles, compliance policies, application deployment
• Exchange Online and Teams administration, including migrations
• Azure infrastructure: subscriptions, RBAC, virtual networks, VPN connectivity, and enough PowerShell or Graph API fluency to script what you'd otherwise click through twice
• Comfortable working escalations across multiple client environments in the same day — context-switching is the job, not an interruption to it
• Clear written communication. You'll write for clients, for teammates who inherit your work, and occasionally for assessors.

Helpful, not required

• Microsoft GCC High or Azure Government experience, including working knowledge of where GCC High diverges from Commercial in features, licensing, and external collaboration
• NIST SP 800-171 or CMMC exposure — implementing controls, supporting an assessment, or working POA&M findings to closure
• Microsoft certifications: AZ-104, MS‑102, SC‑300, AZ‑500, MD‑102, or similar
• Defender suite and Microsoft Sentinel administration
• Cisco Meraki: MX firewall policy, VLAN segmentation, wireless
• Prior work at an MSP or MSSP

First 90 days

By day 30, you're taking Tier 2/3 escalations independently across at least three client environments. By day 60, you're running a buildout or migration workstream with support from the Technical Lead. By day 90, you own environment delivery end to end — scoping input, execution, documentation, handoff to support.

Why this is worth your time

You'll work in both worlds — commercial cloud where the platform moves fast, and government cloud where the constraints make the expertise scarce. Most engineers get one or the other; here you build depth in both, and the GCC High side compounds into a skill set the market underprices right now.

We are also automating the parts of managed services delivery that should never have been manual. If you have opinions about what should be a script instead of a ticket, you'll be listened to.

Company Description

Two Five Solutions is a Washington, DC managed IT, security, and compliance firm built by problem solvers who refuse to run things the way the industry always has. We serve defense contractors and regulated enterprises operating in Microsoft GCC High, Azure Government, and commercial cloud — environments where the work is hard, the stakes are real, and the expertise you build compounds. We automate everything that should never have been manual, we push each other to find the better way, and we measure ourselves on the value clients actually get. If you want your ideas heard, your work visible, and your skills growing faster than they would anywhere bigger, this is that place.