Cloud Operational Engineer Level 3

About the Role

We are looking for a Cloud Operational Engineer (L3) to become the most senior technical authority in our Cloud Operations team and the final escalation point for our client estate.

This is a hands‑on role with real authority. You will hold the access you need to resolve work end to end, in Entra , Azure, Intune and across our clients’ SaaS estate, rather than diagnosing a problem and passing it to somebody else. If you have spent time in roles where you knew exactly what the fix was but could not action it, this is the opposite of that.

You will spend your time on the work that genuinely needs senior judgement: complex incidents, identity and access operations, platform troubleshooting, and root cause analysis on the issues that keep coming back. Alongside that, you will turn what you know into runbooks and standards the wider team can use, so that expertise lives in the system rather than in one person’s head.

This is an operations role, not a project role. You will not be pulled onto client implementations or infrastructure builds. Our Engineering (Professional Services) team owns design, build and delivery. You own how the platform runs once it is live, and you own the standards it runs to.

What You Will Do

Monitoring and operational response

• Triage and resolve platform alerts across the monitoring estate, covering availability, performance, capacity and configuration drift

• Judge quickly which alerts represent genuine service impact and which do not, and act accordingly

• Turn recurring alert patterns into problem records and automation candidates rather than working them repeatedly

• Own operational response for managed file transfer and scheduled job failures, including rerun, validation and client communication

Identity and access operations

•
Entra : user and guest lifecycle, group membership, cross‑tenant collaboration, attribute and licensing changes

•
Azure RBAC and PIM: role assignment within an approved scope catalog, and time‑bound privileged access within a defined role set

•
App registrations and service principals: creation against standard patterns, secret and certificate lifecycle, API permissions and admin consent

•
Credential hygiene: proactive rotation and renewal of secrets and certificates ahead of expiry, handled as scheduled work rather than as incidents

•
Conditional Access and MFA: investigate authentication failures, analyze policy behavior and impact, and support security investigations

Platform operations

•
Microsoft 365: Exchange Online mail flow, shared mailboxes and distribution lists, quarantine and anti‑spam handling, SharePoint and One Drive access models, Teams policy and governance

•
DNS and domains: record changes across managed zones, new domain onboarding, and mail authentication records including SPF, DKIM and DMARC

•
Data platform access: access and permission operations across Microsoft Fabric, Databricks, Snowflake and Azure SQL

•
Federation and SSO: configure and operate enterprise applications, SAML federation and SCIM provisioning for third‑party SaaS

•
Endpoint and virtual desktop: Intune configuration and application deployment across Windows, macOS, iOS and Android, plus Azure Virtual Desktop and Cloud PC session and profile troubleshooting

•
Compute and infrastructure: availability, performance, access and capacity issues across existing virtual machine estates

Incidents, problems and root cause

• Act as technical lead during major incidents, including client‑facing technical communication under pressure

• Own root cause analysis on significant and recurring incidents, and drive preventive actions through to closure

• Identify systemic risk and recurring failure patterns, and convert them into problem records with named owners

• Escalate…