Role & responsibilities

- Roll out MFA on email, remote access and admin accounts first, then to all users, with Conditional Access policies that allow only managed devices.

- Clean up identity: remove stale admin rights and leaver accounts, set up role-based admin, and enforce same-day offboarding.

- Configure Intune device compliance and enrollment for Windows laptops, working with the endpoint engineer on the standard build.

- Set up alerting on bulk downloads, impossible travel and unusual sign-ins in Microsoft 365 and connected SaaS apps.

- Apply data protection (sensitivity labels, DLP) for staff who handle patient data, scoped rather than tenant-wide.

- Harden Azure and M365 tenant settings against Secure Score and CIS benchmarks; document every change.





- Support license right-sizing with evidence of which features each user group actually needs.

Preferred candidate profile

- 5+ years in Microsoft identity and cloud security.

- Hands-on with Entra ID (Conditional Access, PIM, MFA methods), Intune, Exchange Online protection and the M365 admin and security centers.

- Can explain which security features sit in which M365 license (E3, E5, F3, Entra P1/P2) and design around a license constraint.

- PowerShell or Graph API scripting for bulk changes and reporting.

- Has rolled out MFA to 1,000+ users with a measured adoption and support plan.

📌 Azure__Security_Engineer (Hyderabad)
🏢 Modern Signal Services
📍 Hyderabad