Senior Cloud Engineer I (Microsoft 365/Entra)

Location: Hybrid, with three days per week in the Crystal City, Virginia office; applicants must be authorized to work full-time in the United States. Certain projects may require specific residency.

Anticipated annual salary: $140,000–$165,000 USD for candidates based in the United States.

Company

hirify.global is a nonpartisan, not-for-profit organization conducting behavioral and social science research and delivering technical assistance in the United States and globally.

What you will do

• Design, configure, administer, and optimize Microsoft 365 services including Exchange Online, SharePoint Online, OneDrive, Teams, Copilot, and security and compliance features.
• Administer and harden Entra ID through conditional access, identity protection, app registrations, role-based access control, MFA, federation, and privileged identity management.
• Own Exchange Online mail flow, transport rules, connectors, policies, hybrid connectivity, and advanced mail-delivery troubleshooting.
• Investigate incidents and security events using Microsoft 365 Defender, Purview, Sentinel, and Log Analytics; create KQL detections, reports, and root-cause analyses.
• Develop PowerShell automation, scripts, integrations, documentation, standards, runbooks, and architectural diagrams, while contributing to CI/CD and infrastructure-as-code practices.
• Collaborate with security and networking teams, support containerized workloads integrating with M365/Entra, lead complex incident response, and mentor junior collaborators.

Requirements

• Bachelor’s degree in Computer Science, Computer Engineering, or a related discipline with at least 9 years of relevant IT experience; or a master’s degree with at least 7 years of relevant experience; or at least 15 years of relevant industry experience.
• At least 5 years of hands-on Microsoft 365 and Entra ID administration experience in a mid- to large-enterprise environment.
• Expert-level Exchange Online experience covering mail-flow troubleshooting, advanced transport configuration, security and compliance policies, and third-party integrations.
• Strong KQL experience with Microsoft 365 Defender, Sentinel, or Log Analytics for log queries, custom detections, and security or operational event analysis.
• Exposure to Azure DevOps, GitHub, or similar tools for scripts, pipelines, and infrastructure-as-code definitions for Microsoft 365.
• Deep understanding of identity and access concepts, including SSO, OAuth/OIDC, federation, conditional access, MFA, and privileged identity management.
• Proficiency with PowerShell for automation, bulk operations, and Microsoft 365 and Entra ID configuration management.
• Knowledge of M365 security, compliance, and governance capabilities, including DLP, retention, eDiscovery, auditing, and safe links or attachments.
• Ability to communicate with technical and non-technical clients, work independently and collaboratively, manage concurrent deliveries, and apply analytical, critical-thinking, problem-solving, and detail-oriented skills.
• Familiarity with Kubernetes or AKS and its integration with Entra ID for identity and access control.
• Must currently be authorized to work full-time in the United States.

Nice to have

• Experience with Microsoft Graph API for automation, integration, and advanced reporting.
• Experience with Microsoft Sentinel or similar SIEM platforms for M365 and Entra monitoring and analytics.
• Experience with LSoft List-Plex.
• Passion for the craft and ability to understand technology at both high-level and detailed levels.

Culture & Benefits

• Hybrid work arrangement with three office days per week and occasional travel for meetings, training sessions, and conferences.
• Full-time employment with AIR’s Total Rewards Program.
• Reference and background checks are required, along with adherence to child safeguarding standards.
• AIR maintains a drug-free work environment and provides reasonable employment-process accommodations.
• Employment-based visa sponsorship, including H-1B sponsorship, is not available.