Systems Engineer

You will own client projects in the Microsoft 365 stack from scoping through delivery. Expect to spend your first week learning our RMM and PSA. After that you are running projects on your own, managing the timeline, communicating with the client, and getting it done.

This is a hands-on engineering role. You will be in the tenant doing the work, not writing plans for someone else to execute. If you need daily direction to keep moving, this is not the right fit. If you would rather own something and be trusted to finish it, it probably is.

What you will do

• Deploy and support Intune for Windows, macOS, iOS, and Android, including Autopilot, Apple Business Manager, Android Enterprise enrollment, compliance and configuration policies, and app deployment
• Configure and tune Defender for Endpoint, Defender for Office 365, and Defender for Identity across client tenants
• Deploy and operate Purview: sensitivity labels, DLP, retention, and eDiscovery, with an eye toward CUI handling requirements
• Administer existing Sentinel workspaces: triage incidents, maintain connectors, adjust analytics rules, run KQL queries.
• Configure Conditional Access and Entra ID
• Automate recurring work with PowerShell and Microsoft Graph
• Administer Windows Server and Hyper-V or VMware environments: Active Directory, Group Policy, DNS, DHCP, file services, patching, and backups
• Support client networks: firewalls, switching, VLANs, VPN, and Wi-Fi
• Handle hardware refreshes, server builds, and site work when a client needs hands on site
• Handle escalated tickets our Service Desk cannot close
• Document work in a way that supports CMMC evidence and SSP requirements
• Follow change management. Plan the change, communicate it, execute it, confirm it

• 4+ years hands-on in Microsoft 365 administration and security, with direct Intune, Defender, and Entra experience
• Working experience with Purview.
• Solid Windows Server and Active Directory administration, plus enough networking to troubleshoot a firewall, VLAN, or VPN issue without escalating
• Solid PowerShell. You reach for a script before you reach for the portal when the task repeats
• MSP or small-team background where you were the engineer, not one of twenty
• Comfortable walking a client through a change and explaining what you did and why
• Ability to take a loosely defined project and drive it to done without daily check-ins

Nice to have

• Sentinel deployment or KQL experience
• GCC High tenant experience
• CMMC Level 2 or NIST SP 800-171 project work
• Microsoft certs: MS-102, SC-400, SC-200, SC-300
• FortiGate certification or deep experience
• Familiarity with NinjaOne or a comparable RMM, * Microsoft 365: 4 years (Required)
• Microsoft Defender: 2 years (Required)
• Microsoft Intune: 4 years (Required)

Ability to Commute:

• Chesapeake, VA 23320 (Required)

• 90 minute working session in a sandbox tenant, screen shared. You will complete two or three tasks from our actual backlog while we talk through your approach
• Deep-dive interview on one project from your resume
• References focused on what you owned and how fast you delivered

Pay: $75,000.00 - $95,000.00 per year, * 401(k)

• 401(k) matching
• Dental insurance
• Flexible schedule
• Health insurance
• Health savings account
• Paid time off
• Retirement plan
• Vision insurance

Application Question(s):

• Have you worked in an environment that aligned toward NIST 800-171
• How you owned from start to finish a full Microsoft 365 implementation with littel to no guidance?