Senior Cloud Engineer

AIR is in search of a Senior Cloud Engineer to spearhead the design, administration, and enhancement of our Microsoft 365 and Entra ID ecosystem. This is crucial for supporting our mission-driven, research-focused organization. As a technical expert and strategic partner, you will play a vital role in ensuring our cloud collaboration and identity platforms are secure, resilient, and optimized for a diverse workforce. You will collaborate with engineering, security, and operational teams to strengthen AIR's cloud posture, drive automation, and implement top-tier governance and security practices.

This role is a perfect fit for an experienced engineer who thrives in complex enterprise environments, enjoys tackling challenging technical issues, and is passionate about developing scalable, secure, and well-architected cloud services. You will have the opportunity to influence long-term cloud strategy, mentor junior staff, and contribute significantly to AIR's mission to enhance lives through research, evidence, and innovation.

This position allows for remote work within the United States or from one of AIR's U.S. office locations, excluding U.S. territories.

About AIR: AIR, founded in 1946 and headquartered in Arlington, Virginia, is a nonpartisan, not-for-profit organization conducting behavioral and social science research and delivering technical assistance to tackle some of the most pressing challenges in the U.S. and globally. We generate evidence and provide data-driven solutions that expand opportunities and improve lives for everyone.

Key Responsibilities

• Design, configure, and manage Microsoft 365 services, including Exchange Online, SharePoint Online, OneDrive, Teams, Copilot, and related security/compliance features.
• Administer and secure Entra ID (Azure AD), focusing on conditional access, identity protection, app registrations, and role-based access control.
• Oversee Exchange Online configuration, including mail flow, transport rules, connectors, policies, and hybrid connectivity, along with advanced troubleshooting of mail delivery issues.
• Utilize Kusto Query Language (KQL) in Microsoft 365 Defender, Purview, and Log Analytics to investigate incidents, identify trends, and develop detection queries and reports.
• Partner with security and networking teams to implement and sustain security baselines, Data Loss Prevention (DLP), retention, eDiscovery, and auditing across the M365 environment.
• Develop and maintain automations, scripts, and integrations using PowerShell and Microsoft Graph API to enhance administration, reporting, and provisioning processes.
• Contribute to CI/CD and Infrastructure-as-Code practices (using tools such as Azure DevOps and GitHub) for Microsoft 365 configurations and related workloads.
• Work with containerized and cloud workloads (e.g., Kubernetes) where they interface with M365/Entra for identity, security, or application access.
• Lead complex incident responses and root-cause analyses for M365 and identity-related outages or security events.
• Create and maintain technical documentation, standards, runbooks, and architectural diagrams for Microsoft 365 and Entra services.
• Mentor junior administrators and provide guidance on best practices, governance, and operational excellence.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, or a related field with at least 9 years of relevant experience, or a master's degree with at least 7 years of relevant experience, or at least 15 years of relevant industry experience.
• Minimum of 5 years of hands-on administration with Microsoft 365 and Entra ID in a mid to large enterprise environment.

Skills

• Effective communicator with the ability to understand and connect with both technical and non-technical stakeholders.
• Proven capability to work independently as well as collaboratively.
• Adept at managing multiple concurrent projects in a fast-paced environment.
• Strong analytical, critical thinking, and problem-solving skills, with attention to detail and quality.
• Expert-level experience with Exchange Online, including mail flow troubleshooting, advanced transport configuration, and security policies.
• Extensive experience using KQL in tools such as Microsoft 365 Defender, Sentinel, or Log Analytics.
• Deep understanding of identity and access concepts, including SSO, OAuth/OIDC, federation, conditional access, and MFA.
• Proficient in PowerShell for automation, bulk operations, and configuration management in Microsoft 365 and Entra ID.
• Solid grasp of security, compliance, and governance functionalities within M365.
• Familiarity with Azure DevOps, GitHub, or similar tools for managing scripts and Infrastructure-as-Code definitions.
• Exposure to container platforms (e.g., Kubernetes/AKS) and their integration with Entra ID.
• Experience with Microsoft Graph API and Microsoft Sentinel is preferred, but not mandatory.
• Familiarity with Varonis, AWS, or Google Workspace is a plus.
• A strong passion for the technology and a demonstrated ability to learn at various levels.

Disclosures: Applicants must be authorized to work in the U.S. on a full-time basis. Employment-based visa sponsorship is not available for this position. Qualified candidates may need to meet specific residency requirements based on project work.

AIR is an equal opportunity employer. All qualified applicants will receive consideration for employment without discrimination based on age, race, color, religion, sex, gender identity/expression, sexual orientation, national origin, protected veteran status, or disability. All selected candidates will undergo reference and background checks. AIR maintains a drug-free work environment.

If you require reasonable accommodation during the employment process due to a disability, please send a request via email.

Fraudulent Job Scams Warning: Please note that AIR recruitment will only communicate from an '@air.org' email domain. Be cautious of scams and report any suspicious activity.

The anticipated annual salary range for this position is $140,000-$164,000 USD.