Microsoft Cloud Engineer

Two Five Solutions, LLC.; Washington, Northern (District of Columbia, KY); Hybrid; USD 120,000 - 150,000; Full time

Job summary

Two Five Solutions LLC is seeking a Microsoft Cloud Engineer to design and operate Microsoft 365 and Azure environments, including GCC High and commercial tenants in Washington, DC. You’ll stand up tenants, run migrations, and act as Tier 2/3 escalation across our client base in a hands‑on role.

The engineer will own environment buildouts, migrations, and security baselines while delivering runbooks and knowledge‑base content for ongoing support.

Qualifications

• 5+ years of hands-on Microsoft 365 and Azure in a MSP, gov or enterprise setting.
• Tenant buildout and migrations for GCC High and commercial environments.
• Entra ID, Conditional Access and MFA design.
• Intune, Autopilot, device enrollment and compliance policy implementation.
• Exchange Online and Teams administration including migrations.

Responsibilities

• Build new GCC High and Commercial tenants, Azure landing zones and identity baselines.
• Provide Tier 2/3 escalations across Microsoft 365, Entra ID, Intune and Azure.
• Maintain standards and hardening to align tenants with baselines.
• Create runbooks and maintain knowledge base articles for support teams.

Skills

Microsoft 365 & Azure

Tenant buildout

Entra ID

Intune & Autopilot

Exchange Online & Teams

PowerShell/Graph API

Tools

PowerShell / Graph API

Job description

Two Five Solutions LLC Microsoft Cloud Engineer Washington, DC·Full time Company website

Two Five Solutions is hiring a Microsoft Cloud Engineer to build and support Microsoft 365 and Azure environments — both GCC High and commercial — for our defense industrial base and regulated commercial clients. You'll stand up new tenants, run migrations, and serve as Tier 2/3 escalation across our client base, working out of our Washington, DC office. This role requires 5+ years of hands‑on Microsoft 365 and Azure experience; GCC High, NIST/CMMC exposure, and Microsoft certifications are a plus. It's a chance to build depth in both commercial and government cloud — a combination the market underprices — at a firm small enough that your work is visible.

About Two Five Solutions LLC

Two Five is a cybersecurity and automation solutions firm that helps organizations operate smarter, scale faster, and grow securely. We deliver expert solutions across Governance, Risk & Compliance (GRC), Managed Services, Strategic Consulting, and Innovation & Automation. By combining deep technical knowledge with business‑first thinking, we empower our clients to reduce risk, streamline operations, and unlock the full potential of AI and automation. Whether you're building secure infrastructure, navigating compliance, or accelerating transformation, Two Five is your trusted partner for resilient growth.

Description

The role

Two Five Solutions runs managed IT, managed security, and CMMC 2.0 compliance programs for defense industrial base contractors and regulated commercial firms. Our client environments span Microsoft GCC High, Azure Government, and commercial Microsoft 365 and Azure — and we build them, migrate into them, and operate them end to end.

We need an engineer who can do both halves of that: stand up new environments — GCC High and commercial tenants, Azure landing zones, identity and endpoint baselines — and carry Tier 2/3 support across the client base once they're live. You will be a senior technical resource on the delivery team, working escalations the service desk can't close and running buildout projects with real delivery dates.

This is not a Tier 1 helpdesk role. Ticket intake and first response stay with our service desk; you take what escalates and you build what's new.

What you'll own

Environment buildouts and migrations (~40%). New Microsoft 365 tenants in GCC High and Commercial, Azure and Azure Government landing zones, Entra ID and Intune baselines, tenant‑to‑tenant migrations, and the integration of acquired companies' users, devices, and data. These are scoped, billable projects — you own the delivery.

Tier 2/3 support across the client base (~40%). Escalations from the service desk across Microsoft 365, Entra ID, Intune, Exchange Online, Defender, and Azure infrastructure — in both GCC High and commercial tenants. You diagnose, resolve, and document so the same issue doesn't elevate twice.

Standards and hardening (~10%). Keep client tenants aligned to our configuration baselines — Conditional Access, device compliance, endpoint hardening — and flag drift before it becomes a finding or an incident.

Runbooks and documentation (~10%). Every environment you build gets a runbook. Every escalation pattern you resolve gets a knowledge‑base article the analyst tier can use.

What you need

• 5+ years of hands‑on Microsoft work — administering and engineering Microsoft 365 and Azure in a managed services, systems engineering, or internal IT role. This is the requirement; everything below describes what that experience should look like.
• Tenant buildout experience: you have stood up Microsoft 365 tenants and Azure environments from nothing, not just administered ones someone else built
• Entra ID: Conditional Access, MFA design, identity lifecycle, hybrid identity with Entra Connect
• Intune and Autopilot: device enrollment, configuration profiles, compliance policies, application deployment
• Exchange Online and Teams administration, including migrations
• Azure infrastructure: subscriptions, RBAC, virtual networks, VPN connectivity, and enough PowerShell or Graph API fluency to script what you'd otherwise click through twice
• Comfortable working escalations across multiple client environments in the same day — context‑switching is the job, not an interruption to it
• Clear written communication. You'll write for clients, for teammates who inherit your work, and occasionally for assessors.

Helpful, not required

• Microsoft GCC High or Azure Government experience, including working knowledge of where GCC High diverges from Commercial in features, licensing, and external collaboration
• NIST SP 800-171 or CMMC exposure — implementing controls, supporting an assessment, or working POA&M findings to closure
• Defender suite and Microsoft Sentinel administration
• Prior work at an MSP or MSSP

First 90 days

By day 30, you're taking Tier 2/3 escalations independently across at least three client environments. By day 60, you're running a buildout or migration workstream with support from the Technical Lead. By day 90, you own environment delivery end to end — scoping input, execution, documentation, handoff to support.

Why this is worth your time

You'll work in both worlds — commercial cloud where the platform moves fast, and government cloud where the constraints make the expertise scarce. Most engineers get one or the other; here you build depth in both, and the GCC High side compounds into a skill set the market underprices right now.

We are also automating the parts of managed services delivery that should never have been manual. If you have opinions about what should be a script instead of a ticket, you'll be listened to.