Microsoft Security Engineer

GuidePoint Security is seeking a hands-on Microsoft Security Engineer to join our Microsoft Cloud Security Team. The role centers on Entra ID, Purview, Intune, and Defender XDR, delivering security engagements toward an 80 percent billable target in a remote capacity with limited travel.

Responsibilities

• Design and implement identity architecture for Entra ID and on-premises Active Directory, including hybrid sync via Entra Connect, Conditional Access, MFA and passwordless options, plus identity governance (PIM, RBAC, access reviews, entitlement management).
• Enable application integration through SSO using SAML and OIDC, manage enterprise app registrations, and configure SCIM provisioning.
• Assess and remediate identity risks using Entra ID Protection and analyze sign-in and audit logs; improve hybrid identity hygiene through stale object cleanup, privileged account reduction, and tiered admin models.
• Data security and compliance with Purview: design and implement sensitivity labels, data loss prevention, and retention policies across Microsoft 365; support data classification, information protection rollouts, and data security posture assessments.
• Provide support for eDiscovery, Insider Risk Management, communications compliance, and AI data security readiness (DSPM for AI) as engagements require.
• Intune and Defender XDR: configure device compliance, configuration profiles, and application deployments across platforms; support Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps in cloud and hybrid environments.
• Other duties as assigned.
• Adhere to GuidePoint Security Core Values.

Requirements

• Bachelor's degree preferred.
• 2 to 5 years in IT administration, identity management, or security operations.
• Hands-on production experience with Microsoft Entra ID and on-premises Active Directory, including Conditional Access, MFA, RBAC, and hybrid identity (Entra Connect).
• Knowledge of core authentication protocols: SAML, OAuth 2.0/OIDC, Kerberos, LDAP.
• Experience implementing Microsoft Purview (sensitivity labels, DLP, retention, or eDiscovery) and comfort supporting Intune and Defender XDR.
• Basic PowerShell scripting for automation and reporting (for example, Microsoft Graph PowerShell).
• Strong troubleshooting skills, meticulous attention to detail, and clear written and verbal communication.
• openness to emerging technologies, including AI tools, to improve problem solving and business outcomes.

Technologies

• Microsoft Entra ID
• Active Directory
• Conditional Access
• RBAC
• PIM
• SAML
• OAuth 2.0
• OIDC
• Kerberos
• LDAP
• SCIM
• Entra ID Protection
• Purview
• DLP
• eDiscovery
• Intune
• Defender XDR
• Defender for Endpoint
• Office 365
• Microsoft Graph PowerShell
• PowerShell
• Azure Policy
• Azure
• SharePoint Online
• Teams
• Power BI
• Fabric
• Copilot Studio
• Azure AI Foundry
• Entra Connect
• Microsoft 365
• DSPM

Benefits

• Remote workforce primarily; U.S. based; some travel may be required for certain positions; on-site work may be required for Federal positions.
• Group Medical Insurance options include a Zero Deductible PPO plan with GuidePoint covering 90% of the employee premium and 70% for family plans, or a High Deductible Health Plan with HSA with GuidePoint covering 100% of the employee premium and 75% for family plans; HDHP/HSA includes quarterly employer contributions of $850 per employee or $1,750 per family annually.
• Group Dental Insurance with GuidePoint paying 100% of the employee premium and 75% of family plans.
• 12 corporate holidays and a Flexible Time Off program.
• Healthy mobile phone and home internet allowance.
• Eligibility for retirement plan after two months at open enrollment.
• Pet benefit option.

Travel Requirements

• This role is 100% remote with travel limited to less than 10 percent for corporate events.

Physical Requirements

• Sedentary work.
• Substantial repetitive movement of the wrists, hands, and fingers for up to 8 hours per day.
• Close visual acuity to view computer terminals and extensive reading for up to 8 hours per day.

Location

Remote