Staff Cloud Services Engineer

Key Responsibilities

• Manage the configuration of Cisco secure email gateways, including inbound and outbound routing, policies, quarantine, and encryption.
• Design, manage, and troubleshoot Exchange Online services, including transport rules, connectors, accepted and remote domains, mailbox and distribution group settings, and migrations.
• Design, configure, and optimize Microsoft Defender for Office 365 policies, including anti-spam, anti-phishing with impersonation protection, anti-malware, Safe Links, Safe Attachments, and pre-set security policies.
• Own email authentication for all company domains: SPF, DKIM, DMARC.
• Design and support SMTP relay and application email services.
• Onboard and govern applications, devices (e.g., multifunction printers and scanners), and SaaS platforms that send email on behalf of company domains, ensuring they are authenticated, approved, and documented.
• Investigate and remediate phishing, business email compromise, spoofing, and malware campaigns with the Security Operations team, using Threat Explorer, message trace, Advanced Hunting, and automated investigation and response.
• Monitor mail flow health, deliverability, queue, and reputation issues using Exchange Admin Centre, Defender portal, message trace, Microsoft 365 Service Health, and gateway reporting.
• Support Microsoft Purview controls applicable to email: data loss prevention, sensitivity labels, message encryption, retention, eDiscovery, and journaling.
• Use ServiceNow and Jira to manage incidents, requests, problems, changes, and project activities in line with operational processes.
• Create and maintain designs, runbooks, mail flow diagrams, standards, domain and sender inventories, and knowledge articles.
• Provide clear technical guidance and knowledge transfer to service desk teams, application owners, and other engineers.

Role Scope & Technical Ownership

• SMTP relay services for applications, devices, and third-party platforms.
• Exchange Online and mail flow architecture, including routing through secure email gateways.
• Microsoft Defender for Office 365 and the wider email threat protection stack.
• Domain and sender governance: SPF, DKIM, DMARC enforcement and the inventory of approved senders.
• Email-related identity and access controls, including Conditional Access, modern authentication, and the removal of legacy protocols.
• Email data protection and compliance with Microsoft Purview.
• Technical leadership during email incidents, including deciding when to block, quarantine, reroute, roll back a change, escalate, or engage a specialist.
• Global service delivery, Incident, Change, and Problem Management, root-cause analysis, and preventative actions.
• Automation with PowerShell (Exchange Online, Microsoft Graph), Power Automate, and Logic Apps to improve operations and reporting.
• Mentoring less-experienced engineers and service desk teams.

Requirements & Tech Stack

• Exchange Online & Messaging:
• Hands-on professional experience engineering and supporting Exchange Online in a large enterprise.
• Strong knowledge of mail flow: connectors, transport rules, accepted domains, centralized mail transport, and routing through third-party gateways.
• Experience with mailbox types, shared and resource mailboxes, distribution and Microsoft 365 groups, permissions, and migrations.
• Confident use of message trace, Exchange Admin Centre, Microsoft 365 Service Health, and Microsoft support escalation.
• Email Security:
• Practical experience configuring and tuning Microsoft Defender for Office 365.
• Experience administering secure email gateways.
• Detailed understanding of SPF, DKIM, DMARC, ARC, MTA-STS, and TLS, and experience moving domains to DMARC enforcement.
• Experience investigating phishing, spoofing, and business email compromise with Security Operations teams.
• Working knowledge of email encryption, data loss prevention, and sensitivity labels in Microsoft Purview.
• SMTP & Application Email:
• Deep understanding of SMTP: the protocol, headers, response codes, TLS negotiation, MX and DNS records, and bounce (NDR) analysis.
• Experience designing and supporting SMTP relay for applications and devices, including authenticated submission, connector-based relay, and third-party relay services.
• Experience planning and delivering the retirement of Basic Authentication and legacy SMTP AUTH.
• Ability to diagnose deliverability problems: blocklists, IP and domain reputation, throttling, and recipient-side rejections.
• Identity, Automation & Operations:
• Working knowledge of Entra ID, Conditional Access, modern authentication, and licensing as they apply to messaging.
• Strong PowerShell skills (Exchange Online module, Microsoft Graph); experience with Power Automate or Logic Apps is desirable.
• Working understanding of DNS, firewalls, proxies, and TLS certificates.
• Strong systematic troubleshooting: restore service first, then complete root-cause analysis.
• Experience managing incidents and changes through ServiceNow or a comparable IT service management platform.
• Communication & Customer Support:
• Ability to explain technical issues clearly to the audience and give concise, actionable updates.
• Comfortable working under time pressure, for example during an active phishing campaign, while maintaining sound judgment.
• Professional written and spoken English suitable for global engineering, security, and business teams.

Personal Attributes

• Accountable: Owns technical issues from first diagnosis through restoration, escalation, and closure.
• Security-minded: Balances protection against deliverability and user experience, and documents decisions.
• Calm, methodical, and decisive during live incidents such as phishing campaigns or mail flow outages.
• Curious and committed to keeping up with changes in Microsoft 365, email standards, and the threat landscape.
• Confident making recommendations, and comfortable admitting knowledge gaps and bringing in specialists.
• Collaborative and non-territorial, working well with security, identity, network, and application teams.
• Organized and detail-oriented, with a commitment to documentation, standards, change control, and knowledge transfer.
• Respectful and constructively challenging, able to push back on risky sender or relay requests without undermining colleagues.
• Comfortable working independently while staying connected to a globally distributed team.

Qualifications

• Microsoft 365 Certified: Messaging Administrator Associate, or equivalent experience.
• Microsoft Certified: Security Operations Analyst Associate (SC-200) or Information Protection Administrator Associate (SC-400).
• Vendor training or certification from Proofpoint, Mimecast, Egress, or a similar email security provider.
• Experience with DMARC reporting platforms.
• Experience in a large enterprise with many domains, business units, or acquired companies.
• Experience supporting mergers, acquisitions, or divestments: domain migration, coexistence, and mail routing during transition.
• ITIL Foundation or equivalent service management knowledge.