Staff Cloud Services Engineer

We are seeking an experienced Email Security & Microsoft 365 Messaging Engineer to own engineering, operation and continuous improvement of enterprise email platform, mail flow and email security services across a global estate. This is a hands-on technical role for a professional who can take ownership of complex incidents and engineering work, not an entry-level or developmental position.

The successful candidate will manage, evolve, support Exchange Online, Microsoft Defender for Office 365, Microsoft Purview, Cisco secure email gateways, SMTP relay services Public DNS configuration and hygiene adhering to industry standards. They will work with security, identity, network and application teams, and with suppliers, to keep email secure, deliverable, compliant and reliable.

• Manage the configuration of Cisco secure email gateways, including inbound and outbound routing, policies, quarantine and encryption.
• Design, manage and troubleshoot Exchange Online services, including transport rules, connectors, accepted and remote domains, mailbox and distribution group settings, and migrations.
• Design, configure and optimize Microsoft Defender for Office 365 policies, including anti-spam, anti-phishing with impersonation protection, anti-malware, Safe Links, Safe Attachments and pre-set security policies.
• Own email authentication for all company domains: SPF, DKIM, DMARC
• Design and support SMTP relay and application email services
• Onboard and govern applications, devices (such as multifunction printers and scanners) and SaaS platforms that send email on behalf of company domains, making sure they are authenticated, approved and documented.
• Investigate and remediate phishing, business email compromise, spoofing and malware campaigns with the Security Operations team, using Threat Explorer, message trace, Advanced Hunting and automated investigation and response.
• Monitor mail flow health, deliverability, queue and reputation issues, using Exchange Admin Centre, Defender portal, message trace, Microsoft 365 Service Health and gateway reporting.
• Support Microsoft Purview controls that apply to email: data loss prevention, sensitivity labels, message encryption, retention, eDiscovery and journaling.
• Use ServiceNow and Jira to manage incidents, requests, problems, changes and project activities in line with operational processes.
• Create and maintain designs, runbooks, mail flow diagrams, standards, domain and sender inventories, and knowledge articles.
• Provide clear technical guidance and knowledge transfer to service desk teams, application owners and other engineers.

This is an experienced engineering role responsible for independently handling complex work, making sound operational decisions and contributing to the technical direction of messaging and email security. It includes broad technical ownership across:

• SMTP relay services for applications, devices and third-party platforms.
• Exchange Online, and mail flow architecture, including routing through secure email gateways.
• Microsoft Defender for Office 365 and the wider email threat protection stack.
• Domain and sender governance: SPF, DKIM, DMARC enforcement and the inventory of approved senders.
• Email-related identity and access controls, including Conditional Access, modern authentication and the removal of legacy protocols.
• Email data protection and compliance with Microsoft Purview.
• Technical leadership during email incidents, including deciding when to block, quarantine, reroute, roll back a change, escalate or engage a specialist.
• Global service delivery, Incident, Change and Problem Management, root-cause analysis and preventative actions.
• Automation with PowerShell (Exchange Online, Microsoft Graph), Power Automate and Logic Apps to improve operations and reporting.
• Mentoring less-experienced engineers and service desk teams.

• Hands-on professional experience engineering and supporting Exchange Online in a large enterprise.
• Strong knowledge of mail flow: connectors, transport rules, accepted domains, centralized mail transport, and routing through third-party gateways.
• Experience with mailbox types, shared and resource mailboxes, distribution and Microsoft 365 groups, permissions and migrations.
• Confident use of message trace, Exchange Admin Centre, Microsoft 365 Service Health and Microsoft support escalation.

• Practical experience configuring and tuning Microsoft Defender for Office 365
• Experience administering secure email gateway
• Detailed understanding of SPF, DKIM, DMARC, ARC, MTA-STS and TLS, and experience moving domains to DMARC enforcement.
• Experience investigating phishing, spoofing and business email compromise with Security Operations teams.
• Working knowledge of email encryption, data loss prevention and sensitivity labels in Microsoft Purview.

• Deep understanding of SMTP: the protocol, headers, response codes, TLS negotiation, MX and DNS records, and bounce (NDR) analysis.
• Experience designing and supporting SMTP relay for applications and devices, including authenticated submission, connector-based relay and third-party relay services.
• Experience planning and delivering the retirement of Basic Authentication and legacy SMTP AUTH.
• Ability to diagnose deliverability problems blocklists, IP and domain reputation, throttling, and recipient-side rejections.

• Working knowledge of Entra ID, Conditional Access, modern authentication and licensing as they apply to messaging.
• Strong PowerShell skills (Exchange Online module, Microsoft Graph); experience with Power Automate or Logic Apps is desirable.
• Working understanding of DNS, firewalls, proxies and TLS certificates.
• Strong systematic troubleshooting: restore service first, then complete root-cause analysis.
• Experience managing incidents and changes through ServiceNow or a comparable IT service management platform.

• Ability to explain technical issues clearly to the audience and give concise, actionable updates.
• Comfortable working under time pressure, for example during an active phishing campaign, while keeping sound judgement.
• Professional written and spoken English suitable for global engineering, security and business teams.

• Accountable: owns technical issues from first diagnosis through restoration, escalation and closure.
• Security-minded: balances protection against deliverability and user experience, and document why each decision was made.
• Calm, methodical and decisive during live incidents such as phishing campaigns or mail flow outages.
• Curious and committed to keeping up with changes in Microsoft 365, email standards and the threat landscape.
• Confident making recommendations, and comfortable admitting knowledge gaps and bringing in specialists.
• Collaborative and non-territorial, working well with security, identity, network and application teams.
• Organized and detail-oriented, with a commitment to documentation, standards, change control and knowledge transfer.
• Respectful and constructively challenging, able to push back on risky sender or relay requests without undermining colleagues.
• Comfortable working independently while staying connected to a globally distributed team.

The ideal candidate is a strong messaging engineer who understands email end to end from SMTP and DNS on the wire, through Exchange Online and the security stack, to the people and applications that depend on it. They are neither only an Exchange administrator nor only a security analyst.

They do not need expert knowledge of every product. More important is the breadth to understand how mail flow, security controls, identity and DNS interact, to isolate the likely fault quickly, and to engage the right specialists when needed.

Hands-on Exchange Online and email security experience, strong SMTP troubleshooting, calm decision-making, clear communication and the ability to work at an experienced engineering level within a collaborative global team are essential.

• Microsoft 365 Certified: Messaging Administrator Associate, or equivalent experience.
• Microsoft Certified: Security Operations Analyst Associate (SC-200) or Information Protection Administrator Associate (SC-400).
• Vendor training or certification from Proofpoint, Mimecast, Egress or a similar email security provider.
• Experience with DMARC reporting platforms.
• Experience in a large enterprise with many domains, business units or acquired companies.
• Experience supporting mergers, acquisitions or divestments: domain migration, coexistence and mail routing during transition.
• ITIL Foundation or equivalent service management knowledge.