> Markdown version of [/jobs/ext/203970-implementation-operations-engineer](https://www.wearedevelopers.com/jobs/ext/203970-implementation-operations-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Implementation & Operations Engineer - **Company:** nuvioIT LLC - **Location:** Norfolk, VA, United States - **Experience:** Experienced - **Salary:** $75,000.0 - $85,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Active Directory Federation Services, Microsoft Azure, Cloud Computing, Cloud Engineering, Data Migration, Hyper-V, Virtual Private Networks (VPN), Python (Programming Language), Log Analysis, Microsoft Security Essentials, Microsoft Office, Performance Tuning, Windows PowerShell, Kusto Query Language, Runbook, Microsoft SharePoint, Security Information and Event Management, Virtual Local Area Networks, Wireless Access Point, Scripting, Transport Layer Security, Computer Network Operations, Microsoft Power Automate, Firewalls (Computer Science), Microsoft InTune, Deployment Automation, Microsoft Sentinel, Fortinet, 3-tier Architectures, CIS Benchmarks, Firewall Services Module, SentinelOne Expertise, Cisco, Key Vault, Vmware - **Published:** May 21, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=ab582501a64622bd ## About the Role Do you have a valid Driver's License license?, Do you have experience in Windows?, Hard Requirements * 4-6 years of professional IT/security engineering experience, with at least 3 years of recent, hands-on Microsoft 365 security stack work in production environments * You can independently scope and deliver an M365 migration project * You have personally configured Microsoft Defender (Endpoint, Identity, Office 365) in production. You can describe how you tuned a rule, triaged an alert, and closed a finding * You have personally designed and deployed Microsoft Intune configuration profiles, compliance policies, and app protection policies. You can describe the difference between a configuration profile and a compliance policy without thinking about it. * You have personally designed Conditional Access policy stacks in production. You can explain the trade-offs between named-location-based, device-compliance-based, session-control-based, and risk-based policies, and how you handle break-glass coverage. * Working competence with Microsoft Sentinel - data connectors, basic KQL, rule tuning. * Comfortable in PowerShell - Microsoft Graph SDK, Exchange Online, Entra, Intune. * Hands-on networking competence - you can configure VLANs on a managed switch, build firewall rules from scratch, and troubleshoot a site-to-site VPN tunnel. Fortinet experience preferred but not required. * Valid US driver's license. You will drive to client sites occasionally. * US citizenship with no disqualifying factors for federal security clearance (clearance not required at hire, but candidate must be clearable). * Strong written communication. Change records, runbooks, and client-facing project updates are part of every deliverable. Strongly Preferred * Direct hands-on experience with Microsoft 365 GCC High - tenant builds, migrations, or steady-state operations. Even one prior GCC High engagement is a meaningful differentiator. * MSP / MSSP - you understand multi-tenant work, change windows, ticket-driven delivery, and client communication norms. * Active or recent Microsoft certifications: SC-200, SC-300, SC-400, MS-102, AZ-500, or equivalent legacy credentials (MS-500, MCSE). * Hands-on familiarity with CIS Benchmarks, DISA STIGs, or Microsoft Security Baselines applied to production environments. * Experience with SentinelOne, Huntress, Cisco Duo, ConnectWise PSA/RMM, Fortinet. * Working familiarity with CMMC Level 2, NIST SP 800-171, or DFARS 7012 from an implementation point of view. You do not need to be the policy author, you need to be able to read a control and configure to it. Bonus Points * Active or recent DoD security clearance (Secret or higher) * Prior DIB contractor experience - inside a prime, sub, or on the MSP side serving DIB clients * Hyper-V or VMware experience for server consolidation projects * Hybrid identity experience - Entra Connect, ADFS, on-premises AD integration * Azure infrastructure experience beyond M365 - networking, Key Vault, log analytics, Azure governance * Scripting or automation beyond PowerShell - Python, Logic Apps, Power Automate ## Description This is a hands-on engineering role with two halves The first half is implementation: leading client projects end-to-end such as GCC High tenant builds and migrations, Microsoft security stack deployments, hardening engagements, network refresh and segmentation work, workstation lifecycle initiatives, and new-client onboardings. You will own these projects from kickoff through go-live and warranty period. The second half is operations: maintaining what you and we have built. This incldues configuration drift audits, baseline tuning, vendor coordination, Tier 3 escalation, and the steady-state engineering work that keeps DIB-grade environments DIB-grade after the project closes. The president of the company does not see escalated tickets; you are the buck-stop. Approximate workload mix (transparent expectations) * Project implementation: ~20-30% GCC High migrations, stack deployments, hardening engagements * Steady-state operations & Tier 3 escalation: ~25-30% * Onsite work at client locations: ~10-15% endpoint deployment, network gear, in-person remediation * Internal engineering & documentation: ~10-15% nuvioIT's own stack, runbooks, evidence artifacts * Mentorship & cross-team collaboration: ~5-10% service desk Tier 2/3 development What You'll Actually Do Project Implementations You will lead these project types independently from kickoff through transition to ongoing support. We are listing them at the level of specificity we expect you to be able to scope and deliver: * Microsoft 365 Commercial to GCC High tenant migrations - identity cutover, mail and SharePoint/OneDrive data migration, endpoint re-enrollment, conditional access rollout, license reconciliation * Greenfield Microsoft 365 GCC High tenant builds for CMMC-aligned DIB subcontractors - zero to user-ready, hardened to baseline * Microsoft Defender stack deployments - Endpoint, Identity, Office 365, Cloud Apps - including rule tuning, ASR rules, alert workflow integration * Microsoft Intune deployments - configuration profiles, compliance policies, app protection policies, Autopilot Hybrid and Cloud-native, Windows update rings * Conditional Access policy stack design and rollout - named locations, device compliance, session controls, risk-based policies, break-glass coverage * Microsoft Sentinel SIEM deployments - data connectors, baseline analytic rules, KQL tuning, workbook deployment * Fortinet firewall deployments and refreshes - VLAN segmentation, site-to-site VPN configuration, SSL inspection where applicable, log forwarding to SIEM * Endpoint lifecycle initiatives - workstation refresh, OS standardization, hardware procurement coordination, deployment via Autopilot * New office build-outs and office moves - network gear procurement and configuration, endpoint enrollment, M365 baseline application, user onboarding * Migration off non-compliant tooling Ongoing Operations & Tier 3 * Quarterly configuration drift audits across client M365 tenants and network gear - identify deviations from baseline, remediate, document * Microsoft Intune compliance and configuration policy maintenance - keeping baselines current as Microsoft features evolve * Conditional Access policy reviews and tuning - quarterly review cadence per client * Microsoft Defender alert triage - take escalations from Tier 1/2, drive root cause and remediation * Tier 3 escalation - any technical issue the service desk cannot close * Vendor coordination - Microsoft, SentinelOne, Huntress, Duo, Fortinet, ConnectWise for complex configuration, integration, and support issues * Network operations across client environments - switch and firewall configuration changes, VLAN adjustments, troubleshooting Onsite Work This role includes periodic onsite work at client locations. Typical onsite work includes: * Endpoint deployment and remediation for clients without remote-only support options * Network gear installation and rack work - switches, firewalls, access points, cabling * Migration cutover support - being on-site for critical user-experience moments * In-person client engagement at kickoff and major project milestones A valid US driver's license is required. Mileage and travel are reimbursed. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [WebAssembly: The Next Frontier of Cloud Computing](https://www.wearedevelopers.com/videos/972-webassembly-the-next-frontier-of-cloud-computing) - [How Cisco embraced a DevOps culture within its network engineering team](https://www.wearedevelopers.com/videos/99-how-cisco-embraced-a-devops-culture-within-its-network-engineering-team) - [Your Infrastructure Is Not a Playground: AI Agents for Infra Done Right](https://www.wearedevelopers.com/videos/2084-your-infrastructure-is-not-a-playground-ai-agents-for-infra-done-right) - [Generating code with Angular schematics](https://www.wearedevelopers.com/videos/129-generating-code-with-angular-schematics) - [Computer Vision from the Edge to the Cloud done easy](https://www.wearedevelopers.com/videos/263-computer-vision-from-the-edge-to-the-cloud-done-easy) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [6 Emerging Technologies We’ll Learn About in 2025](https://www.wearedevelopers.com/magazine/381-6-emerging-technologies-we-ll-learn-about-in-2025)