Five Guys Europe
M365 Security Infrastructure Administrator
London
Posted about 21 hours ago
Get notified of more jobs like this · No spam, ever
How your CV stacks up
1Upload CV
2Analyse CV
3Improve CV
Upload your CV to see how well it fits this job role
?%
Role Overview
As the Microsoft 365 & Security Infrastructure Administrator, you will be the technical lead Responsible for the implementation and operational integrity of our tenant’s foundation. While the Head of Cybersecurity defines the "Why" and the strategic vision, you will translate that vision into a concrete technical specification (the "What") and engineer the deployment path (the "How").
This is a deep-technical role focused on structural optimization and hands-on configuration. You will ensure that our Microsoft estate is not only secure but architected according to the latest Microsoft Modern Cloud Administration principles, moving away from "case-by-case" ad-hoc management toward scalable, automated operations. We are looking for a proactive solution-finder who prioritizes long-term system integrity over short-term fixes.
Outcomes for Success
- Scalable Infrastructure: Successful transition from ad-hoc, case-by-case management to a fully automated, policy-driven environment.
- Proactive Security: Identifying and remediating security gaps before they are exploited, with a focus on long-term stability and platform integrity.
- Technical Compliance: Every device accessing corporate data is technically compliant with defined security standards.
- Zero-Touch Operations: Secure, automated provisioning is fully operational, reducing manual intervention and human error.
- Metrics-Driven Operations: A regular cadence of high-signal reporting is established, providing the Head of Cybersecurity with clear visibility into platform health, risk reduction, and the success of scalable automation.
- Audit Readiness: All configurations and technical inventories are documented as "code," ready for evidence-based review at any time.
Key Responsibilities
1. Identity, Access & Segregation (EntraID)
- Structural Optimization & Segregation: Continuously analyze and optimize the Entra ID organizational structure using Administrative Units (AUs) and Scoped Administration to enforce strict segregation of duties and data access.
- Identity First: Act as the subject matter expert for EntraID. Implement and maintain advanced Conditional Access policies aligned to business risk.
- Privileged Access & Segregation: Manage and audit administrative roles, service accounts, and shared identities. Implement PIM (Privileged Identity Management) to ensure just-in-time access and prevent over-privilege.
- Workload & AI Agent Identity: Govern service principals, managed identities, and AI agent identities (e.g., Copilot agents) to ensure responsible, auditable, and secure automation.
- Lifecycle Management: Ensure joiner/mover/leaver (JML) processes are technically sound, automated where possible, and strictly enforced.
2. Endpoint Security & Device Management (Intune)
- MDM & MAM: Technical implementation lead for Microsoft Intune, configuring Mobile Device Management (MDM) and Mobile Application Management (MAM) across Windows, MacOS, iOS, and Android.
- Device Compliance: Configure and maintain "Health & Compliance" policies (e.g., encryption, OS versions, password complexity) to ensure devices meet corporate standards before accessing data.
- Automated Deployment: Configure Windows Autopilot, MacOS Automated Device Enrollment, and Apple Business Manager (ABM) integrations for a zero-touch, secure provisioning experience.
- Security Posture: Implement endpoint hardening using Intune configuration profiles (e.g., BitLocker, FileVault, Firewall, ASR rules).
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
3. Platform Hardening & Security Baselines
- Secure-by-Design: Implement and maintain security baselines across Exchange Online, SharePoint, OneDrive, Teams, Viva, and Copilot as defined by the cybersecurity strategy.
- Exchange Online Security: Configure and maintain mail flow, encryption (OME), and advanced threat protection. Audit SPF, DKIM, and DMARC records for deliverability and spoofing prevention.
- Policy Enforcement: Prevent "configuration drift" by implementing consistent, global policy sets and monitoring for deviations.
- Threat Protection: Configure and tune email security (Anti-Phishing, Spoofing, Malware) and data loss prevention (DLP) settings.
4. Azure Tenant & Modern Cloud Governance
- Data Residency & Compliance: Configure and monitor tenant settings to ensure data residency compliance across all workloads, including AI/Copilot, in accordance with legal and regulatory requirements.
- Scalable Management: Design and implement management-at-scale, moving away from manual, case-by-case exceptions to consistent, policy-driven automation.
- Modern Administration: Proactively stay updated with Microsoft’s latest cloud administration principles (e.g., Zero Trust, modern lifecycle management) and implement them to ensure the tenant remains secure and efficient.
- Tenant Operations: Maintain Azure tenant-level settings, including RBAC, management groups, and subscription governance.
- Automation-First Mindset: Utilize Terraform and PowerShell to automate repetitive tasks, ensuring that all technical changes are version-controlled, repeatable, and documented.
5. SharePoint & Collaboration Governance
- Site Lifecycle: Technical delivery of SharePoint site templates and management of the technical end-to-end lifecycle (creation to archiving).
- External Sharing: Implement and monitor technical controls on external sharing and guest access.
6. Compliance, Audit & Documentation
- Evidence Collection: Maintain technical configuration standards that meet audit requirements (GDPR, PCI, internal reviews).
- Technical Documentation: Author and maintain the "Five Guys Standard" technical documentation for M365/Intune.
7. Reporting, Analytics & Metrics
- Choice of Metrics: Define and select high-signal KPIs to measure the effectiveness of all technical implementations (e.g., identity security, device compliance, platform health).
- Proactive Reporting: Establish and maintain automated reporting dashboards for the Head of Cybersecurity, providing visibility into the "Health & Security Posture" of the Microsoft estate.
- Performance Tracking: Use data to track the transition from ad-hoc management to scalable automation, demonstrating risk reduction and operational efficiency.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Technical Requirements & Experience
Essential Skills:
- Expert EntraID & Intune: Deep implementation experience with Conditional Access, Workload Identities, and Microsoft Endpoint Manager (Intune).
- Identity-Centric Security: Practical experience with PIM, Defender for Cloud Apps (MCAS), and AI/Copilot technical governance.
- Exchange Online Mastery: Deep technical knowledge of mail flow, transport rules, and security protocols (DMARC/DKIM/SPF).
- Device Management: Hands-on experience with Windows 10/11, MacOS (including FileVault/Profiles), iOS, and Android management.
- Infrastructure as Code: Proficiency with Terraform for automated tenant management.
- Core M365 Stack: Advanced technical administration of Exchange Online, SharePoint Online, and Microsoft Teams.
- Security Implementation: Practical experience translating industry-standard security frameworks (e.g., NIST CSF, CIS) into technical configurations.
Desirable Skills:
- Hands-on experience with Windows Autopilot and Apple Business Manager (ABM).
- PowerShell scripting for advanced automation across Intune and M365.
- Experience with Microsoft Purview (Compliance/Information Protection) implementation.
Personal Attributes & Soft Skills
1. Vision Translation & Strategy Execution
- Bridge the Gap: Ability to understand the strategic "Why" (from leadership) and translate it into a concrete technical "What" and a robust "How."
- Strategic Execution: Strong focus on delivering long-term, scalable outcomes rather than just ticking off tickets or short-term fixes.
2. Proactive & Solution-Oriented Mindset
- Root-Cause Focus: Natural inclination to identify and solve underlying architectural issues rather than just treating symptoms on a case-by-case basis.
- Proactive Resilience: Self-starter who anticipates potential technical gaps and proposes automated solutions before they become operational risks.
3. Modern Cloud Mentality
- Continuous Learner: High degree of curiosity and a commitment to staying current with Microsoft’s rapidly evolving cloud and AI landscape.
- Scalability First: Instinctive drive to automate manual tasks and implement policy-driven management at scale.
4. Technical Communication & Governance
- Clear Articulation: Ability to explain technical specifications and technical risks to both technical peers and non-technical stakeholders (including the Head of Cybersecurity).
- Attention to Detail: Rigorous approach to critical configurations, such as data residency, access segregation, and least-privilege principles.
5. Data-Driven & Analytical
- Measurable Impact: Natural tendency to define success through data, selecting the right metrics to validate the success of technical changes.
- Reporting Insight: Ability to turn complex technical logs and configurations into clear, high-level dashboards and reports for leadership.
Trusted by 25,000+ job seekers
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location