> Markdown version of [/jobs/ext/3690940-senior-microsoft-cloud-engineer](https://www.wearedevelopers.com/jobs/ext/3690940-senior-microsoft-cloud-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Microsoft Cloud Engineer - **Company:** ATOM CYBER SECURITY LLC - **Location:** Tinley Park, IL, United States - **Experience:** Expert - **Salary:** $125,000.0 - $145,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Azure, Microsoft Online Services, Cyber Security, Identity and Access Management, Key Management, Virtual Desktops, Network Diagrams, Role-Based Access Control, Kusto Query Language, Sharepoint Document Library, Runbook, Microsoft SharePoint, Toolchain, Information Security Management System, Microsoft InTune, Microsoft Sentinel - **Published:** October 11, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=0cec56f28762624a ## About the Role Candidates must have hands-on experience provisioning and administering Microsoft GCC High environments. Azure Commercial experience alone is insufficient - the build schedule has no capacity to absorb a GCC High learning curve., Candidates without direct GCC High or M365 Government environment experience will require a ramp period this build cannot accommodate. * M365 GCC High: hands-on tenant provisioning and administration; Azure Commercial equivalents do not qualify * Microsoft Sentinel: MSSP workspace architecture, cross-workspace KQL, Lighthouse-delegated RBAC, analytics rule configuration * Azure Virtual Desktop: deployment and administration in Azure Government (not commercial AVD) * Microsoft Intune (GCC High): device enrollment, Compliance policies, Conditional Access integration * Entra ID Governance: Privileged Identity Management (PIM), Conditional Access, Named Locations, Identity Protection * Microsoft Lighthouse: multi-tenant delegation configuration and RBAC scoping for MSSP management * Azure Arc: server and hybrid endpoint onboarding and management * SharePoint GCC High: site architecture, permissions model, and document library structure * Azure Key Vault: provisioning, access policy configuration, and secrets management, * CrowdStrike Falcon sensor deployment and policy baseline configuration - Falcon Gov and/or Falcon Commercial * Azure DevOps Boards configuration and administration * Prior experience building or operating within a CMMC Level 2 or FedRAMP High environment * Client-facing technical experience - security advisory, vCISO support, client onboarding, or security architecture reviews * Microsoft certifications: SC-200, SC-300, AZ-800/801, MS-102, or equivalent Physical Requirements * Extended periods of sitting and computer/office equipment use. * Ability to operate a computer keyboard, mouse, and other office equipment. * Ability to work on occasion to respond to security incidents outside normal business hours. * Primarily an office environment; occasional travel to client sites may be required. * Ability to lift up to 50 lbs. * Valid driver's license and reliable form of transportation. ## Description Infrastructure Build * Provision Atom's GCC High Operations Tenant through an AOS-G authorized partner and build the parallel Azure Commercial Operations Tenant as isolated sovereign tracks * Establish Entra ID baseline across both tenants: admin account structure, security group naming conventions, and identity governance configuration * Deploy Azure Virtual Desktop host pool in Azure Government for SOC analyst and vCISO secure access * Configure Microsoft Lighthouse delegation framework across both tracks to support multi-client MSSP management * Implement FIDO2/phish-resistant MFA and Conditional Access policies across all administrative accounts on both tenants Identity and Access Governance * Configure Privileged Identity Management (PIM) for all privileged roles across both tenants * Enroll all analyst devices, vCISO devices, and AVD session hosts into GCC High and Commercial Intune respectively * Document the separate Entra identity model (distinct UPNs per track) as a formal access control artifact Security Toolchain Deployment * Stand up Microsoft Sentinel MSSP workspaces on both tracks with baseline analytics rules, alert routing, and cross-workspace KQL queries * Apply Defender XDR P2 baseline policy across the GCC High tenant * Deploy CrowdStrike Gov endpoint agents to CMMC client environments; deploy CrowdStrike Commercial Falcon for non-CMMC clients * Activate Azure Arc and Intune management on Atom operations devices * Verify track separation end-to-end and reflect findings in finalized network diagrams Legacy Tool Migration * Build SharePoint GCC High site structure to receive runbooks, SOPs, and client documentation migrated from legacy documentation platforms * Configure Azure DevOps Boards (GCC High) as the ticketing and work management replacement * Provision Azure Key Vault and execute controlled credential migration with documented access policy review * Update Atom's System Security Plan (SSP) to remove transitional tool entries upon retirement confirmation Go-Live and Growth * Support compliance documentation sprints - provide infrastructure evidence artifacts for SSP completion * Conduct end-to-end Lighthouse delegation testing for both anchor clients prior to go-live * Complete final infrastructure verification pass against the go-live readiness checklist * Support onboarding of client accounts to the Atom service delivery model post-launch As the practice scales, participate in client-facing technical work - including vCISO engagements, client onboarding, security architecture reviews, and direct advisory relationships with DIB and commercial clients