Sr. Azure Systems Administrator

Tract Capital Management; Denver (CO); On-site; USD 130,000 - 150,000; Full time

Job summary

Tract Capital Management seeks a Sr. Azure Systems Administrator to own the administration and security of the Microsoft Azure/M365 ecosystem, with a focus on AIM (Entra ID Governance). Responsibilities include automated provisioning, PIM, CA/SSO, and governance across Defender/Sentinel, Intune, and email security.

You will develop PowerShell automation, coordinate with Microsoft and vendors, and drive architecture decisions with minimal direction.

Qualifications

• 5+ years managing Microsoft Azure/365 ecosystem.
• Experience automating identity provisioning/deprovisioning via HRIS.
• Proficiency in Entra ID Governance and PIM administration.

Responsibilities

• Own Entra ID Governance configuration and access management.
• Design and maintain Conditional Access policies and SSO.
• Administer PIM for just-in-time privileged access.
• Automate onboarding/offboarding with HRIS attributes.
• Maintain audit logs and compliance reporting across access events.

Skills

Entra ID Governance

PIM

HRIS provisioning

Intune/Autopilot

Microsoft 365

PowerShell

Windows Server/AD

Email security

eDiscovery tooling

Education

Bachelor's degree in CS/IS

5+ years Azure/365 experience

Certifications: AZ-104/SC-300

Tools

PowerShell scripting

Entra ID governance admin

Intune/Autopilot

Defender/Sentinel

Job description

Summary/Objective

At Tract, the Sr. Azure Systems Administrator owns the administration, and security of the Microsoft Azure/365 ecosystem, with special ownership of Automatic Identity Management (AIM) — the automated identity governance and lifecycle layer built on Microsoft Entra ID. This includes Entra ID Governance (entitlement management, access packages/catalogs, access reviews), automated provisioning/deprovisioning tied to HRIS events, Privileged Identity Management (PIM), and Conditional Access/SSO. Beyond AIM, the role is accountable for the broader Azure/M365 environment: Intune, Defender detections, Sentinel SIEM, sensitivity label management, email security, and business continuity. The position requires development and maintenance of automation scripts, strong vendor coordination (Microsoft and managed security partners), and the judgment to make key architecture decisions with minimal direction.

Responsibilities

Automatic Identity Management (AIM) — Entra ID Governance

• Own Entra ID Governance configuration: entitlement management (access packages and catalogs), identity lifecycle automation (automated provisioning, expiry notifications, renewal, and deprovisioning), and scheduled access reviews.
• Administer Privileged Identity Management (PIM) for just-in-time privileged role activation.
• Design and maintain Conditional Access policies (MFA, device compliance, risk-based sign-in) and SSO for both internal and external (B2B) identities.
• Partner with HR/IT to automate onboarding and offboarding so that access provisioning and deprovisioning require no manual IT intervention, mapping HRIS attributes to Entra ID groups and downstream application access.
• Maintain full audit logging and compliance reporting for every access request, approval, provisioning event, and review outcome.

Azure / Microsoft 365 Systems Administration

• Make key design and configuration decisions for Defender, Sentinel SIEM, sensitivity label management, and Intune/Autopilot endpoint management.
• Administer Power Platform governance (Power Automate, Power Apps, Power BI, DLP) via their respective admin centers.
• Own change management, disaster recovery, performance optimization, and service availability for the Azure/M365 environment.

Cross-Platform / General

• Perform day-to-day administration, maintenance, and documentation of standards/policies across AIM and the broader Azure/M365 environment, including monitoring of associated service contracts, SLAs, and performance metrics.
• Develop and maintain PowerShell/automation scripts to streamline identity governance and systems administration.
• Develop and implement strategic and tactical plans, working closely with Microsoft and other external vendors or professional services groups to resolve issues, upgrade, optimize, or implement solutions.
• Serve as a point of escalation and support for the 24/7 Helpdesk and international IT administrators.

Knowledge, Skills, And Abilities

• Hands-on experience administering Microsoft Entra ID Governance: entitlement management, access packages/catalogs, access reviews, and identity lifecycle automation
• Experience managing Privileged Identity Management (PIM) and Conditional Access policies
• Experience with SCIM-based or HRIS-driven automated identity provisioning/deprovisioning (e.g., Rippling-to-Entra ID or comparable)
• Experience managing Intune/Autopilot and endpoint compliance
• Experience managing Microsoft 365 (Exchange, SharePoint, Teams, Power Platform)
• PowerShell scripting experience or equivalent .NET development
• Windows Server and Active Directory administration experience
• Experience managing email security appliances/services, SPAM/phishing mitigation, and encryption
• Knowledge of SQL, networking/DNS, data storage/clustering, and load balancing
• Knowledge of eDiscovery tooling
• Ability to analyze and revise standards, processes, and procedures across identity governance and systems administration
• Ability to communicate effectively with all international organizations and different levels of technical and managerial personnel
• Skill in providing exceptional customer service

Required Education And Experience

• Bachelor's degree in a business or technical discipline with major coursework in computer science, computer information systems, management information systems, or a related field is preferred
• Prior experience (5+ years) managing the Microsoft Azure/365 ecosystem; international and multi-country experience is preferred
• Experience designing or administering Microsoft Entra ID Governance (entitlement management, access reviews, PIM) or a comparable identity governance platform preferred
• Certifications in one or more of the following disciplines preferred: Microsoft Azure Administrator (AZ-104), Microsoft Identity and Access Administrator (SC-300), Microsoft 365/Exchange/Office 365, ITIL V2/3 Foundation, MCSA/MCSE, or comparable experience
• NetSuite ERP or SuiteCloud/SuiteQL familiarity is a plus but not required for this role

Travel Required: Domestic Travel Required 10%

Expected Salary Range: $130,000 - $150,00 Base Salary + Discretionary Bonus

This Might Be Right For You If:

You're a self-guided individual with an inner drive to manage multiple projects while collaborating with internal staff, external consultants, vendors, and other stakeholders.

You have strong attention to detail and can prioritize workload across implementation projects and support services.

You bring both creative and analytical approaches to complex problems.

You continuously keep up with new products and enjoy learning about new technologies.

Work Authorization

Must pass enhanced background check

Affirmative Action/EEO Statement

Tract provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training.

Other Duties

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.