Intelligent Technical Solutions - CMMC Security Engineer (US Hybrid)
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT
Requirements
• Experience with Microsoft 365 GCC or GCC High environments (tenant provisioning, licensing nuances, feature differences from commercial M365). • Experience with tenant-to-tenant migrations (commercial to GCC/GCC High) using BitTitan MigrationWiz, ShareGate, or native Microsoft tools. • Experience configuring Microsoft Purview: sensitivity labels, auto-labeling, DLP policies across Exchange, SharePoint, Teams, and endpoints. • Experience with FIPS 140-2 configuration and DISA STIG or CIS benchmark implementation via Intune or GPO. • Experience supporting defense industrial base (DIB) or federal contractor IT environments. • Experience with Azure Arc for hybrid server management and Azure Bastion for secure remote administration. • (must hold at least two from this list): • Microsoft Certified: Azure Solutions Architect Expert (AZ-305) - Architecture design and decision-making. • Microsoft Certified: Azure Administrator Associate (AZ-104) - Core Azure resource management. • Microsoft Certified: Security Operations Analyst Associate (SC-200) - Sentinel, Defender, and security operations. • Microsoft Certified: Identity and Access Administrator Associate (SC-300) - Entra ID, Conditional Access, PIM. • Microsoft Certified: Information Protection and Compliance Administrator (SC-400) - Purview, DLP, sensitivity labels. • Microsoft Certified: Endpoint Administrator Associate (MD-102) - Intune and device management. • Preferred Certifications • (significant advantage): • CompTIA Security+ (SY0-701) • CMMC Registered Practitioner (RP) - Understanding of CMMC framework from technical perspective. • Microsoft Certified: Cybersecurity Architect Expert (SC-100) • Microsoft 365 Certified: Administrator Expert (MS-102) • Certified Information Systems Security Professional (CISSP) • GIAC certifications (GSEC, GCIA, GCIH) - Deep security operations knowledge. • Execution-focused: ability to follow SOPs and runbooks precisely while identifying when something does not match documented steps and escalating appropriately. • Multi-tenant management: comfortable switching between 4-7 different client Azure/M365 environments daily without cross-contaminating configurations. • Documentation discipline: every configuration change is documented, every evidence artifact is captured, every deviation from the SOP is noted. • Troubleshooting: when Conditional Access blocks legitimate users, when Sentinel data connectors go unhealthy, or when WDAC blocks a required application, you can diagnose and resolve without waiting for escalation. • Security mindset: you understand why least privilege matters, why default-deny is the correct network posture, and why FIPS-validated encryption is required for CUI. • Clear written communication: when you find something in the client environment that does not match what the GRC Consultant scoped, you can document it clearly so the team can make decisions.
Responsibilities
• Design and deploy CMMC-compliant enclave architectures in Azure: cloud-only (GCC/GCC High), hybrid (on-prem + GCC), and on-premises environments. Select and implement the appropriate topology (hub-spoke, segmented) based on client requirements. • Provision and configure Microsoft 365 GCC and GCC High tenants including initial setup, domain verification, licensing assignment, and tenant hardening. • Configure Microsoft Entra ID: user provisioning, Security Groups, Administrative Units, Conditional Access policies (MFA, device compliance, location-based, session controls), Privileged Identity Management (PIM), and Identity Protection risk policies. • Deploy and configure Microsoft Intune: device enrollment, compliance policies, configuration profiles, security baselines (CIS/STIG), BitLocker encryption with FIPS 140-2 compliance, Windows Update for Business rings, and application management via Company Portal. • Deploy and configure Microsoft Sentinel: Log Analytics workspace setup, data connector deployment (M365, Entra ID, Defender, Azure Activity, Firewall, NSG flow logs), KQL-based analytics rules, automation playbooks (Logic Apps), and CMMC compliance workbooks/dashboards. • Deploy and configure Microsoft Defender for Endpoint: device onboarding, antivirus policies, Attack Surface Reduction (ASR) rules, endpoint DLP, network protection, web content filtering, and vulnerability management. • Configure Microsoft Purview: sensitivity labels (CUI, FCI, Public), auto-labeling policies, DLP policies across Exchange, SharePoint, Teams, and endpoints, and information barriers where required. • Design and implement Azure networking: Virtual Networks, subnets, NSGs, Azure Firewall, Azure Bastion, VPN Gateway (site-to-site and point-to-site), Private Endpoints, route tables, and DDoS Protection. • For hybrid environments: configure Azure AD Connect (or Cloud Sync), hybrid device join, pass-through authentication or password hash sync, split DNS, and Azure Arc for on-premises server management. • Configure encryption across the environment: BitLocker (XTS-AES 256), FIPS 140-2 compliance mode, TLS 1.2+ enforcement, VPN encryption (IKEv2/AES-256), and Purview encryption for CUI-labeled content. • Execute remediation tasks from the CMMC Remediation Tracker as assigned by the GRC Consultant. Each task maps a specific NIST 800-171 control objective to an Azure/M365 configuration with step-by-step instructions. • Capture and organize technical evidence for each implemented control: configuration screenshots, policy exports (JSON), audit log samples, compliance reports, and test results. • Support incident response capability deployment: Sentinel playbook creation, automated notification workflows, and incident response procedure testing. • Perform client environment migrations to GCC/GCC High (tenant-to-tenant migration using BitTitan, ShareGate, or native Microsoft tools). • Work across 4-7 concurrent client environments at various stages of build and remediation. • Job QualificationsRequired Technical Experience • Willing to work in a hybrid setup—remotely or on-site at client locations, as required. • 3+ years hands-on experience administering Microsoft Azure and M365 environments in a professional capacity (not lab-only). • Direct experience configuring Conditional Access policies, Entra ID PIM, and identity architecture (cloud-only and hybrid with Azure AD Connect). • Direct experience deploying and managing Microsoft Intune for endpoint compliance, configuration profiles, security baselines, and BitLocker management. • Direct experience deploying Microsoft Sentinel including data connectors, KQL query writing, analytics rules, and automation playbooks. • Experience configuring Azure networking: VNets, NSGs, Azure Firewall or third-party NVA, VPN Gateway, and network security architecture. • Experience deploying Microsoft Defender for Endpoint including device onboarding, ASR rules, and vulnerability management. • Proficiency with PowerShell and Microsoft Graph API for automation and bulk configuration tasks. • Understanding of NIST SP 800-171 controls and how they map to specific Azure/M365 technical implementations.
Benefits
• Medical Insurance Plan • Dental & Vision • Disability Coverage • Paid Time Off (starts at 15 days per year) • Maternity/Paternity Leave • Paid US Holiday • Retirement Plan • Salary Advancement/Loan • Health & Wellness Program • Company-paid training and certification • Supplemental Life Insurance (Employee-paid) • Supplemental Health Plans (Employee-paid)
Similar Jobs
No credit card. Takes 10 seconds.