Cloud Engineer

There are two ways to qualify for this role.

The work splits into two bodies of expertise that rarely live in the same person, so we hire against either one:

•        Track A — Cloud and Server. Microsoft 365, Entra ID, Azure, Intune, Windows Server, and the mailbox, tenant, and domain migrations that go with them.

The experience bar

•        10 years in IT overall, with at least 2 years of hands-on work in your track.

•        At least five completed projects or migrations you personally executed, with the tooling and platforms named.

•        Level 2 to 3 means you own the technical execution and escalate architecture decisions. You are not expected to design a client's environment from scratch; you are expected to implement one correctly and spot when it is wrong.

What you'll doEveryone in this role runs projects end to end — discovery, plan, pilot, cutover, handover — and everyone works client-facing. What you are cutting over depends on your track.

Common to both tracks

•        Scope a project against the client's actual environment, not the one in the documentation.

•        Agree rollback criteria and a maintenance window with the client before the window opens, and hold to them.

•        Reconcile what actually moved or changed against what was supposed to, and chase the difference.

•        Write the as-built into the client's system of record and brief the service desk, so nothing undocumented is left behind.

•        Keep project time and status current in the PSA so account managers can see where things stand.

•        Join client calls to explain what is changing, what will briefly break, and when.

Track A — Cloud and Server

•        Run mailbox, tenant, file, and Active Directory domain migrations end to end.

•        Build and harden Microsoft 365 tenants: Entra ID, Conditional Access, MFA, SSPR, Exchange Online mail flow, SharePoint and OneDrive structure, Teams provisioning.

•        Configure and troubleshoot hybrid identity — Entra Connect and Cloud Sync, OU and attribute filtering, sync errors, UPN and domain suffix changes, soft-match and hard-match object merges, immutableID collisions.

•        Diagnose mail flow fast when it breaks: MX, SPF, DKIM, DMARC, Autodiscover, connectors, transport rules, message trace.

•        Deploy and maintain Azure infrastructure and Windows Server: VMs, virtual networks, Azure Files, Azure Backup, AD DS, DNS, DHCP, Group Policy, Hyper-V.

•        Manage client devices through Intune: Autopilot enrollment, compliance and configuration profiles, app packaging, BitLocker and Defender policy.

Cloud and server migration delivery — at least two of:

•        On-premises Exchange to Exchange Online: cutover, staged, or hybrid using the Hybrid Configuration Wizard

•        Tenant-to-tenant migration following an acquisition, divestiture, or rebrand

•        Google Workspace or IMAP to Microsoft 365

•        File server or NAS to SharePoint Online, OneDrive, or Teams

•        Active Directory domain migration or consolidation: ADMT, SID history, forest trusts, UPN suffix change, workstation re-domain

•        Another MDM platform into Intune

PowerShell

•        Bulk operations against Exchange Online, Microsoft Graph, and Entra

•        You read and modify scripts rather than only running ones you found