Senior Microsoft 365 Systems Engineer

Riverbay Management Group provides shared operational services, including accounting, finance, legal, technology, payroll and benefits administration, to a group of affiliated healthcare technology and business advisory companies. We are a fully remote, fast-moving team that runs on Microsoft 365. We are seeking an experienced Microsoft 365 system engineer that will also have ongoing management and support responsibilities.

We're looking for a Senior Microsoft 365 Systems Engineer to design, implement and administer our cloud environment across RBMG and its affiliates. You'll own the architecture of our multi-tenant environment, its security and HIPAA compliance, and the roadmap that keeps it ready for a growing, remote, bring-your-own-device (BYOD) workforce. You'll also manage our managed service provider, directing its project work and escalation support.

This is a builder role in a growing organization. You'll shape standards, not just follow them.

What You'll Do

• Architecture and design: Design the multi-tenant Microsoft 365 architecture and security baseline across our affiliated companies, including cross-tenant access, B2B collaboration, and identity and data separation.
• Implementation: Plan and deliver configuration projects, migrations and rollouts end to end, from design through testing, change control and go-live.
• Tenant administration: Administer Exchange Online, Teams, OneDrive and SharePoint, including user lifecycle, licensing, groups, retention settings, service health and configuration documentation.
• Identity and access: Design and administer Microsoft Entra ID, including conditional access, MFA, role-based access and privileged access through Privileged Identity Management (PIM), with approval workflows for high-risk changes.
• Security and compliance: Design, implement and monitor Microsoft Defender, Purview (DLP, sensitivity labels, retention) and Secure Score, and lead response to security alerts and incidents.
• HIPAA technical safeguards: Implement and document technical safeguards for PHI, produce audit evidence, and support Risk Management's risk assessments and breach response.
• BYOD device and app management: Design and administer Microsoft Intune app protection policies (MAM) that secure company data on personal devices while respecting employee privacy.
• Roadmap and governance: Own the Microsoft 365 roadmap, optimize licensing costs, and lead governance for Copilot and other AI tools in the tenant.
• Business continuity: Design and maintain backup and recovery for Microsoft 365 data in partnership with Risk Management.
• MSP management: Scope the MSP's project work, hold it to agreed SLAs, approve its changes, and use it for escalation and after-hours coverage.
• Escalated support: Resolve Tier 2–3 issues and maintain documentation and how-to guides, with routine Tier 1 requests handled through the MSP and our ticketing workflow.

What You Bring

• 5–7+ years administering Microsoft 365 in a cloud-first environment
• Demonstrated experience designing, implementing and managing a multi-tenant Microsoft 365 environment, including cross-tenant access, B2B collaboration and tenant-level security and compliance separation
• Experience supporting IT in a healthcare setting, with a working understanding of HIPAA and how to protect PHI (access controls, data loss prevention, audit logging, retention and breach response)
• Strong working knowledge of Exchange Online, Teams, OneDrive/SharePoint, Entra ID and Intune
• Experience securing BYOD or remote workforces, including conditional access and app protection policies
• Familiarity with Defender and Purview, and with security frameworks or audit support
• PowerShell scripting for Microsoft 365 administration and automation
• Clear communication with non-technical users and a service-first attitude
• Comfort working independently on a small, remote team

Nice to Have

• Microsoft certifications such as MS-102 (Microsoft 365 Administrator Expert), SC-300 or MD-102
• Experience working alongside a managed service provider

What We Offer

• Eligibility for an annual performance bonus with a meaningful target opportunity
• Healthcare coverage
• Open PTO
• Fully remote work