Senior Microsoft 365 Systems Engineer

Riverbay Management Group LLC; United States; Remote; USD 130,000 - 170,000; Full time

Benefits offered by this job

Annual performance bonus

Healthcare coverage

Open PTO

Fully remote work

Job summary

Riverbay Management Group LLC is seeking a Senior Microsoft 365 Systems Engineer to design, implement, and manage a cloud-first multi-tenant Microsoft 365 environment for our organization and affiliates. You will own the architecture, security baselines, and BYOD app protection while overseeing our MSP partner and ensuring HIPAA compliance.

The role focuses on end-to-end migrations, governance, and ongoing optimization across Exchange Online, Teams, OneDrive, and SharePoint, with a strong

Qualifications

• 5–7+ years administering Microsoft 365 in a cloud-first environment.
• Demonstrated experience designing, implementing and managing a multi-tenant Microsoft 365 environment, including cross-tenant access, B2B collaboration and tenant-level security and compliance separation.
• Experience supporting IT in a healthcare setting, with a working understanding of HIPAA and how to protect PHI (access controls, data loss prevention, audit logging, retention and breach response).
• Strong working knowledge of Exchange Online, Teams, OneDrive/SharePoint, Entra ID and Intune.
• Experience securing BYOD or remote workforces, including conditional access and app protection policies.
• Familiarity with Defender and Purview, and with security frameworks or audit support.
• PowerShell scripting for Microsoft 365 administration and automation.
• Clear communication with non-technical users and a service-first attitude.
• Comfort working independently on a small, remote team.

Responsibilities

• Architecture and design: Design the multi-tenant Microsoft 365 architecture and security baseline across our affiliated companies, including cross-tenant access, B2B collaboration, and identity and data separation.
• Implementation: Plan and deliver configuration projects, migrations and rollouts end to end, from design through testing, change control and go-live.
• Tenant administration: Administer Exchange Online, Teams, OneDrive and SharePoint, including user lifecycle, licensing, groups, retention settings, service health and configuration documentation.
• Identity and access: Design and administer Microsoft Entra ID, including conditional access, MFA, role-based access and privileged access through Privileged Identity Management (PIM), with approval workflows for high-risk changes.
• Security and compliance: Design, implement and monitor Microsoft Defender, Purview (DLP, sensitivity labels, retention) and Secure Score, and lead response to security alerts and incidents.
• HIPAA technical safeguards: Implement and document technical safeguards for PHI, produce audit evidence, and support Risk Management's risk assessments and breach response.
• BYOD device and app management: Design and administer Microsoft Intune app protection policies (MAM) that secure company data on personal devices while respecting employee privacy.
• Roadmap and governance: Own the Microsoft 365 roadmap, optimize licensing costs, and lead governance for Copilot and other AI tools in the tenant.
• Business continuity: Design and maintain backup and recovery for Microsoft 365 data in partnership with Risk Management.
• MSP management: Scope the MSP's project work, hold it to agreed SLAs, approve its changes, and use it for escalation and after-hours coverage.
• Escalated support: Resolve Tier 2–3 issues and maintain documentation and how-to guides, with routine Tier 1 requests handled through the MSP and our ticketing workflow.

Skills

Microsoft 365 administration

Microsoft 365 architecture

Entra ID / identity

Intune

Defender / Purview

PowerShell

Cross-tenant access

MSP management

Tools

Exchange Online

Teams

OneDrive/SharePoint

Job description

We're looking for a Senior Microsoft 365 Systems Engineer to design, implement and administer our cloud environment across RBMG and its affiliates. You'll own the architecture of our multi-tenant environment, its security and HIPAA compliance, and the roadmap that keeps it ready for a growing, remote, bring-your-own-device (BYOD) workforce. You'll also manage our managed service provider, directing its project work and escalation support.

This is a builder role in a growing organization. You'll shape standards, not just follow them.

What You'll Do

• Architecture and design:Design the multi-tenant Microsoft 365 architecture and security baseline across our affiliated companies, including cross-tenant access, B2B collaboration, and identity and data separation.
• Implementation:Plan and deliver configuration projects, migrations and rollouts end to end, from design through testing, change control and go-live.
• Tenant administration:Administer Exchange Online, Teams, OneDrive and SharePoint, including user lifecycle, licensing, groups, retention settings, service health and configuration documentation.
• Identity and access:Design and administer Microsoft Entra ID, including conditional access, MFA, role-based access and privileged access through Privileged Identity Management (PIM), with approval workflows for high-risk changes.
• Security and compliance:Design, implement and monitor Microsoft Defender, Purview (DLP, sensitivity labels, retention) and Secure Score, and lead response to security alerts and incidents.
• HIPAA technical safeguards:Implement and document technical safeguards for PHI, produce audit evidence, and support Risk Management's risk assessments and breach response.
• BYOD device and app management:Design and administer Microsoft Intune app protection policies (MAM) that secure company data on personal devices while respecting employee privacy.
• Roadmap and governance:Own the Microsoft 365 roadmap, optimize licensing costs, and lead governance for Copilot and other AI tools in the tenant.
• Business continuity:Design and maintain backup and recovery for Microsoft 365 data in partnership with Risk Management.
• MSP management:Scope the MSP's project work, hold it to agreed SLAs, approve its changes, and use it for escalation and after-hours coverage.
• Escalated support:Resolve Tier 2–3 issues and maintain documentation and how-to guides, with routine Tier 1 requests handled through the MSP and our ticketing workflow.

What You Bring

• 5–7+ years administering Microsoft 365 in a cloud-first environment
• Demonstrated experience designing, implementing and managing a multi-tenant Microsoft 365 environment, including cross-tenant access, B2B collaboration and tenant-level security and compliance separation
• Experience supporting IT in a healthcare setting, with a working understanding of HIPAA and how to protect PHI (access controls, data loss prevention, audit logging, retention and breach response)
• Strong working knowledge of Exchange Online, Teams, OneDrive/SharePoint, Entra ID and Intune
• Experience securing BYOD or remote workforces, including conditional access and app protection policies
• Familiarity with Defender and Purview, and with security frameworks or audit support
• PowerShell scripting for Microsoft 365 administration and automation
• Clear communication with non-technical users and a service-first attitude
• Comfort working independently on a small, remote team

Nice to Have

• Microsoft certifications such as MS-102 (Microsoft 365 Administrator Expert), SC-300 or MD-102
• Experience working alongside a managed service provider

What We Offer

• Eligibility for an annual performance bonus with a meaningful target opportunity
• Healthcare coverage
• Open PTO
• Fully remote work