Staff Cloud Services Engineer

About the Role

We are seeking an experienced Email Security & Microsoft 365 Messaging Engineer to own the engineering, operation, and continuous improvement of the enterprise email platform, mail flow, and email security services across a global estate. This is a hands-on technical role for a professional who can take ownership of complex incidents and engineering work, not an entry-level or developmental position.

Key Responsibilities

• Manage the configuration of Cisco secure email gateways, including inbound and outbound routing, policies, quarantine, and encryption.
• Design, manage, and troubleshoot Exchange Online services, including transport rules, connectors, accepted and remote domains, mailbox and distribution group settings, and migrations.
• Design, configure, and optimize Microsoft Defender for Office 365 policies, including anti-spam, anti-phishing with impersonation protection, anti-malware, Safe Links, Safe Attachments, and pre-set security policies.
• Own email authentication for all company domains: SPF, DKIM, DMARC.
• Design and support SMTP relay and application email services.
• Onboard and govern applications, devices (such as multifunction printers and scanners), and SaaS platforms that send email on behalf of company domains, ensuring they are authenticated, approved, and documented.
• Investigate and remediate phishing, business email compromise, spoofing, and malware campaigns with the Security Operations team, using Threat Explorer, message trace, Advanced Hunting, and automated investigation and response.
• Monitor mail flow health, deliverability, queue, and reputation issues, using Exchange Admin Centre, Defender portal, message trace, Microsoft 365 Service Health, and gateway reporting.
• Support Microsoft Purview controls that apply to email: data loss prevention, sensitivity labels, message encryption, retention, eDiscovery, and journaling.
• Use ServiceNow and Jira to manage incidents, requests, problems, changes, and project activities in line with operational processes.
• Create and maintain designs, runbooks, mail flow diagrams, standards, domain and sender inventories, and knowledge articles.
• Provide clear technical guidance and knowledge transfer to service desk teams, application owners, and other engineers.

Role Scope & Technical Ownership

This is an experienced engineering role responsible for independently handling complex work, making sound operational decisions, and contributing to the technical direction of messaging and email security. It includes broad technical ownership across:

• SMTP relay services for applications, devices, and third-party platforms.
• Exchange Online, and mail flow architecture, including routing through secure email gateways.
• Microsoft Defender for Office 365 and the wider email threat protection stack.
• Domain and sender governance: SPF, DKIM, DMARC enforcement and the inventory of approved senders.
• Email-related identity and access controls, including Conditional Access, modern authentication, and the removal of legacy protocols.
• Email data protection and compliance with Microsoft Purview.
• Technical leadership during email incidents, including deciding when to block, quarantine, reroute, roll back a change, escalate, or engage a specialist.
• Global service delivery, Incident, Change, and Problem Management, root-cause analysis, and preventative actions.
• Automation with PowerShell (Exchange Online, Microsoft Graph), Power Automate, and Logic Apps to improve operations and reporting.
• Mentoring less-experienced engineers and service desk teams.

Requirements & Tech Stack

• Exchange Online & Messaging:
• Hands-on professional experience engineering and supporting Exchange Online in a large enterprise.
• Strong knowledge of mail flow: connectors, transport rules, accepted domains, centralized mail transport, and routing through third-party gateways.
• Experience with mailbox types, shared and resource mailboxes, distribution and Microsoft 365 groups, permissions, and migrations.
• Confident use of message trace, Exchange Admin Centre, Microsoft 365 Service Health, and Microsoft support escalation.
• Email Security:
• Practical experience configuring and tuning Microsoft Defender for Office 365.
• Experience administering secure email gateway.
• Detailed understanding of SPF, DKIM, DMARC, ARC, MTA-STS, and TLS, and experience moving domains to DMARC enforcement.
• Experience investigating phishing, spoofing, and business email compromise with Security Operations teams.
• Working knowledge of email encryption, data loss prevention, and sensitivity labels in Microsoft Purview.
• SMTP & Application Email:
• Deep understanding of SMTP: the protocol, headers, response codes, TLS negotiation, MX and DNS records, and bounce (NDR) analysis.
• Experience designing and supporting SMTP relay for applications and devices, including authenticated submission, connector-based relay, and third-party relay services.
• Experience planning and delivering the retirement of Basic Authentication and legacy SMTP AUTH.
• Ability to diagnose deliverability problems: blocklists, IP and domain reputation, throttling, and recipient-side rejections.
• Identity, Automation & Operations:
• Working knowledge of Entra ID, Conditional Access, modern authentication, and licensing as they apply to messaging.
• Strong PowerShell skills (Exchange Online module, Microsoft Graph); experience with Power Automate or Logic Apps is desirable.
• Working understanding of DNS, firewalls, proxies, and TLS certificates.
• Strong systematic troubleshooting: restore service first, then complete root-cause analysis.
• Experience managing incidents and changes through ServiceNow or a comparable IT service management platform.
• Communication & Customer Support:
• Ability to explain technical issues clearly to the audience and give concise, actionable updates.
• Comfortable working under time pressure, for example during an active phishing campaign, while keeping sound judgment.
• Professional written and spoken English suitable for global engineering, security, and business teams.

Personal Attributes

• Accountable: Owns technical issues from first diagnosis through restoration, escalation, and closure.
• Security-minded: Balances protection against deliverability and user experience, and documents why each decision was made.
• Calm, methodical, and decisive during live incidents such as phishing campaigns or mail flow outages.
• Curious and committed to keeping up with changes in Microsoft 365, email standards, and the threat landscape.
• Confident making recommendations, and comfortable admitting knowledge gaps and bringing in specialists.
• Collaborative and non-territorial, working well with security, identity, network, and application teams.
• Organized and detail-oriented, with a commitment to documentation, standards, change control, and knowledge transfer.
• Respectful and constructively challenging, able to push back on risky sender or relay requests without undermining colleagues.
• Comfortable working independently while staying connected to a globally distributed team.

Desirable Qualifications & Vendor Experience

• Microsoft 365 Certified: Messaging Administrator Associate, or equivalent experience.
• Microsoft Certified: Security Operations Analyst Associate (SC-200) or Information Protection Administrator Associate (SC-400).
• Vendor training or certification from Proofpoint, Mimecast, Egress, or a similar email security provider.
• Experience with DMARC reporting platforms.
• Experience in a large enterprise with many domains, business units, or acquired companies.
• Experience supporting mergers, acquisitions, or divestments: domain migration, coexistence, and mail routing during transition.
• ITIL Foundation or equivalent service management knowledge.