Senior IT Systems Engineer

Trustedtech; United States; Remote; USD 150,000 - 170,000; Full time

Benefits offered by this job

Medical coverage

Dental & vision

401(k) plan

Paid time off

Remote work

Job summary

TrustedTech is seeking a Sr. IT Systems Engineer to own complex Microsoft Cloud and Identity initiatives from scope through production. This fully remote, U.S.-based role requires independent prioritization, strong vendor collaboration, and the ability to operate with minimal direct supervision.

You will manage tenant-level Microsoft 365, Entra ID, and Azure configurations, architect SSO/SCIM integrations, and drive platform migrations while maintaining security and compliance alignment.

Qualifications

• Senior-level ownership of IT projects from scope to production.
• Tenant-level Microsoft 365 administration experience including Exchange Online rules and mail flow.
• Expertise in Entra ID, Conditional Access, Privileged Access Management, and app registrations.

Responsibilities

• Lead enterprise migration and platform consolidation end-to-end.
• Architect and administer Microsoft 365, Entra ID, and Azure environments.
• Design and maintain Intune policies and Autopilot provisioning workflows.
• Develop automation with PowerShell and Microsoft Graph to reduce manual tasks.

Skills

Microsoft 365

Entra ID

Azure

Intune

PowerShell

Microsoft Graph

SSO & SCIM

Automation

Documentation

Vendor management

Tools

AvePoint

BitTitan

Quest

Job description

TrustedTech is a leading Microsoft Cloud Solution Provider (CSP) specializing in Microsoft Cloud services, Microsoft perpetual licensing, and Microsoft Support Services for medium and enterprise-sized businesses. Our robust team of in-house, U.S-based Microsoft architects and engineers are certified in all 6/6 Microsoft Solutions Partner Designations in the Microsoft Cloud Partner Program.

Prioritizing a people-centric mission, TrustedTech has transformed the Microsoft software licensing experience, giving IT professionals complete confidence in the success of their Microsoft investment.

Overview:

The Sr. IT Systems Engineer (Microsoft Cloud & Identity) is the senior technical operator on a deliberately small internal IT team. This is a fully remote, high-autonomy role for an engineer who can quickly absorb a complex Microsoft environment, take complete ownership of initiatives without being managed through them, and reprioritize independently as the business shifts. TrustedTech is a Microsoft Cloud Solution Provider holding all six Microsoft Solution Designations, running a Microsoft-first internal estate across Microsoft 365, Entra ID, Azure, and Intune, supported by a broad portfolio of integrated business platforms.

The internal IT team consists of one other senior infrastructure engineer, the Director of IT, and a two-person support desk. The role functions as a senior individual contributor who takes projects from scope to production, runs point with vendor engineering, and serves as the final internal escalation before leadership. There is no management layer between this person and the work, and no backlog waiting for direction; this role requires someone who defines their own priorities as clearly as they execute against them.

Responsibilities:

Platform Migration & Consolidation

• Lead enterprise migration and platform consolidation initiatives end-to-end, including tooling selection, pilot wave design, third-party integration remediation, cutover planning, and user-facing communication; owning the project from initial scope through production handoff.
• Take new SaaS and cloud platforms from procurement to production, architecting Microsoft Entra ID Single Sign-On, SCIM user provisioning, Conditional Access scoping, and license governance before producing the runbook and handing off cleanly to the helpdesk team.
• Manage the full lifecycle of integration remediation during platform transitions, identifying dependencies, coordinating with third-party vendors, and ensuring the production environment is stable and documented before declaring a cutover complete.

Microsoft Cloud & Identity Architecture

• Own tenant-level design and administration across Microsoft 365, Entra ID, and Azure, including Exchange Online mail flow and transport rules, Conditional Access architecture, Privileged Identity Management, app registrations and API permissions, and Microsoft Purview data governance.
• Architect and maintain hybrid and federated identity configurations, ensuring identity infrastructure is secure, scalable, and aligned to TrustedTech’s least-privilege access standards and compliance requirements.
• Maintain deep, current proficiency across the Microsoft 365 and Entra ID platform, staying ahead of capability changes and deprecations that affect tenant configuration, security posture, or operational processes.

Endpoint & Intune Policy Architecture

• Design and maintain Microsoft Intune compliance baselines, configuration profiles, update rings, Autopilot provisioning workflows, and application deployment strategy across TrustedTech’s device fleet.
• Ensure endpoint policy architecture reflects current security standards and least-privilege principles, with configurations that are maintainable, well-documented, and structured for scale as the organization grows.

Automation & Operational Leverage

• Build durable automation using PowerShell and Microsoft Graph to eliminate recurring manual administration, reduce operational load, and improve consistency across platform management and identity operations.
• Extend workflow automation platforms to support operational efficiency across IT processes, applying an engineering-first mindset to tasks that would otherwise require manual intervention at scale.
• Treating automation as an explicit objective of the role, not an optional add-on; consistently identifying where engineering investment today reduces recurring operational cost tomorrow.
• Serve as the final internal escalation point for complex technical issues before leadership, conducting thorough root-cause analysis and driving issues to resolution rather than workarounds.
• Open, manage, and drive vendor engineering cases through to resolution, holding vendors accountable to their own support commitments and ensuring TrustedTech’s technical issues receive appropriate urgency and expertise.

Security Hardening & Compliance Support

• Execute technical hardening and remediation work assigned by IT leadership, including endpoint protection platform administration, penetration test finding remediation, email security response, and implementation of technical controls that support TrustedTech’s compliance program.
• Hold named senior engineering responsibilities under TrustedTech’s Information Security Management System (ISMS), including secure platform configuration, least-privilege access architecture, privileged access governance, and participation in incident response under the direction of IT leadership.
• Complete mandatory annual security awareness training and maintain the documentation and audit evidence required for TrustedTech’s ongoing ISO 27001 compliance obligations.
• Self-manage a shifting portfolio of projects and escalations with minimal direction, proactively communicating status, tradeoffs, and blockers to IT leadership without being prompted.
• Produce and maintain technical documentation of sufficient quality and completeness that the next engineer to touch a system does not require an explanation from the person who built it; this is a genuine professional standard, not a formality.

Required Skills & Qualifications (must-haves):

• 6+ years of progressive experience in IT systems, cloud, or platform engineering, including 3+ years operating at a senior level with independent ownership of projects from scope through production.
• Deep, tenant-level Microsoft 365 administration experience, including Exchange Online mail flow, transport, and compliance rules, DLP policy behavior, and the ability to diagnose message-level issues end to end.
• Advanced Microsoft Entra ID expertise: Conditional Access architecture, hybrid and federated identity, Privileged Access Management, enterprise application registration, and a working command of the difference between delegated and application API permissions.
• Demonstrated ownership of at least one completed enterprise migration or large-scale platform cutover, personally led end-to-end, including pilot design, integration remediation, and user-facing cutover communication.
• Hands-on Microsoft Intune policy architecture across compliance baselines, configuration profiles, Autopilot provisioning, and application deployment.
• Working proficiency in PowerShell and Microsoft Graph, with real production automation that the candidate can describe, defend, and demonstrate understanding of.
• Direct ownership of SSO and SCIM provisioning integrations across multiple third-party platforms.
• A demonstrated track record of self-management in a lean or unstructured environment: shifting priorities, incomplete requirements, and no one assigning daily work.
• Proven success working fully remotely with distributed stakeholders, including clear asynchronous written communication and reliable availability during Pacific Time business hours.
• Exceptional technical documentation skills and a genuine, demonstrated commitment to writing things down completely and accurately.

Certifications & Professional Development

All certification exams are fully company-funded, and team members qualify for cash incentive bonuses upon successful completion under TrustedTech’s Certification Incentive Program. Certifications may be required within the first year of employment, depending on the credentials held at the time of hire. Candidates with relevant Microsoft credentials at the time of hire are strongly preferred.

• Associate-Level Credential: SC-300 (Identity and Access Administrator Associate) or AZ-104 (Azure Administrator Associate). Either credential satisfies the requirement; selection is based on where the individual’s work is concentrated.
• Expert-Level Credential (Encouraged): AZ-305 (Azure Solutions Architect Expert) or SC-100 (Microsoft Cybersecurity Architect Expert). Fully funded and carrying the highest incentive tier, these credentials directly support TrustedTech’s Microsoft Solution Designation renewals.

Partner Portal Association Requirement

Within 30 days of hire, the Microsoft Learn profile must be linked to TrustedTech in the Microsoft Partner Center and updated immediately upon earning each new credential to maintain organizational skilling compliance.

Work Requirements

• Remote: This position is fully remote within the U.S. and requires a reliable home working environment, consistent availability during Pacific Time business hours, and use of a company-managed, compliance-enrolled device in accordance with TrustedTech’s Acceptable Use Policy. Employment is limited to states in which TrustedTech is registered to operate.
• Travel: Occasional travel to the Irvine, CA office (up to 25%) may be required for project milestones, infrastructure work, or team planning sessions, generally not exceeding a few trips per year. Travel expenses are company-funded.

Preferred Skills & Qualifications (nice-to-haves):

• Hands-on experience with enterprise migration tooling such as AvePoint, BitTitan, Quest, or comparable platforms.
• Administration experience with modern EDR platforms, particularly CrowdStrike Falcon.
• Experience with enterprise email security and anti-abuse platforms (Mimecast or comparable), including response to active mail-based threats.
• Microsoft Purview experience spanning data loss prevention, retention policies, sensitivity labeling, eDiscovery, or legal hold.
• Direct exposure to security framework implementation and audit evidence gathering across ISO 27001, SOC 2, or Cyber Essentials.
• Prior experience inside a Managed Service Provider, Microsoft Partner, or Cloud Solution Provider environment, including familiarity with Partner Center and delegated administration models.
• Integration experience across business platforms such as Slack Enterprise Grid, Salesforce, or NetSuite.
• Experience with low-code or workflow automation platforms such as n8n, Power Automate, or Zapier.
• Foundational networking knowledge, including hands-on management of cloud-managed network infrastructure such as Cisco Meraki.
• Operating Hours: 6:00 am to 3:00 pm PT OR 7:00 am to 4:00 pm PT
• Estimated Salary Range: $150K - $170K (*DOE + certifications held at hire)

- 100% employer-paid base medical coverage: HMO (CA) | PPO (out-of-state)

- Dental and vision coverage

- 401(k) with 4% company match (fully vested)

- Paid vacation, sick leave, and holidays

- Paid parental leave

- Voluntary benefits (STD*, life/AD&D, accident, critical illness, hospital)

- Employee Assistance Program (EAP)

(*Short-term Disability available for employees outside California)

*TrustedTech is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, age, national origin, veteran status, disability, sexual orientation/gender identity, or any other characteristic protected by applicable law.*