We're hiring a
Senior IT Engineer.
Microsoft Modern Work. A small, close team securing Microsoft 365 for SMEs across the UK, where your work will be seen.
Full-time
Monday to Friday
Office-based
with UK site visits
Reports to CTO
small, close team
Take a messy tenant and leave it properly secured.
Black Sheep Support is a UK-based MSP delivering enterprise-grade Microsoft 365 and security services to SMEs. We're bringing on new customers at a steady pace, and we need an experienced Senior IT Engineer who can get stuck in from day one.
This role is for someone who already knows their way around Microsoft 365, Intune and Defender and doesn't need hand-holding. You'll onboard new customers, harden their tenants, build out Intune baselines, tune Defender and get devices enrolled and compliant. Then you'll help keep them that way.
Many new customers come to us with tenants that have grown organically: legacy authentication still enabled, inconsistent MFA, devices that were never properly enrolled and a low Secure Score. Your job is to fix that in a planned, low-disruption way, and leave behind a standard the rest of the team can support.
You'll work alongside our CTO, another Senior IT Engineer and a small team of engineers, and pick up third-line support, mentoring and whatever the priority is on a given day. The role is primarily office-based, with occasional travel to customer sites across the UK and some planned out-of-hours work for cutovers and migrations.
The tools you'll live in
Microsoft Modern Work, end to end.
- Entra ID
- Conditional Access
- Exchange Online
- Secure Score
- Intune
- Windows Autopilot
- Defender for Endpoint
- Defender for Office 365
How you'll onboard a customer.
- 1
Discover
Tenant, device and security audit for each new customer
- 2
Harden
Conditional Access, MFA, legacy auth and admin roles
- 3
Baseline
Intune compliance, security baselines, BitLocker, LAPS
- 4
Protect
Tune Defender for Endpoint and Office 365
- 5
Enrol
Autopilot enrolment and device migration
- 6
Hand over
Documented, compliant and into support
What you'll be doing.
- Leading technical onboarding for new customers, including discovery, tenant and device audits, remediation plans and handover into support
- Hardening Microsoft 365 tenants and improving Secure Score through Conditional Access, MFA, blocking legacy authentication, admin role reviews and Exchange Online protection
- Building and deploying Intune baselines, including compliance policies, configuration profiles, security baselines, BitLocker, Windows LAPS and update rings
- Enrolling and migrating devices with Windows Autopilot, including moving customers away from on-premises domain join and unmanaged devices
- Deploying and tuning Defender for Business and Defender for Endpoint, including onboarding, attack surface reduction rules, alert tuning and remediating vulnerability findings
- Configuring Defender for Office 365 policies and email authentication (SPF, DKIM and DMARC)
- Documenting configurations and changes clearly, so customers and the support team know exactly what was done and why
- Providing third-line support for complex Microsoft 365, Intune and Windows issues
- Contributing to discovery and scoping for new customers, and setting realistic expectations on timescales and effort
- Mentoring other engineers and helping improve our standard builds, processes and documentation
- Picking up whatever needs doing when priorities shift, whether that's a support ticket, a customer call or a site visit
What success looks like.
Running new customer onboardings with minimal supervision
Several tenants hardened end to end, with measurable Secure Score gains and compliant devices
A refined standard baseline, so every new customer gets the same secure setup
What we offer.
25 days leave
Plus bank holidays
Up to 5 extra days
Through our attendance reward scheme
Life assurance
After 12 months of service
Health insurance
After 2 years of service
Early Friday finish
Plus birthday leave, incentives and team socials
Stocked kitchen
Recreation area with free snacks and drinks
Training and certification
Including the Microsoft Certified Professional programme (Modern Work)
Career progression
We promote from within wherever we can
Security the customer can actually live with.
You'll have hands-on experience securing and managing Microsoft 365 environments for multiple customers, ideally within an MSP. You'll be comfortable walking into an unfamiliar tenant, working out what's there and putting together a sensible plan to secure it without breaking the business.
You'll also understand that the best security configuration is one the customer can actually live with. Knowing when to push, when to phase changes in and how to explain the reasoning to a non-technical business owner matters as much as knowing where the settings are.
Essential
- Senior or third-line engineering experience, ideally within an MSP or managed IT services environment
- Hands-on experience securing Microsoft 365 Business Premium, including Entra ID, Conditional Access and Exchange Online
- Strong practical Intune experience, including Autopilot, compliance and configuration policies and app deployment
- Experience deploying and tuning Defender for Endpoint or Defender for Business, and Defender for Office 365
- A track record of measurably improving Secure Score across customer tenants
- Good working knowledge of Windows 11 and Windows Server
- Solid troubleshooting across identity, devices, networking and DNS
- Clear communication, with the confidence to explain technical changes to non-technical stakeholders
- The organisation to run several onboardings at once without anything slipping
- A full UK driving licence and your own vehicle for occasional site visits
Desirable
- Microsoft certifications such as MD-102, MS-102, SC-300 or AZ-104
- PowerShell for automation and reporting
- Experience aligning customers to Cyber Essentials or CIS benchmarks
- Familiarity with Microsoft Purview, Azure and firewall or network configuration
- Experience with an RMM platform such as N-able N-central
Why join Black Sheep Support.
We're a small, close team, so your work will be seen. You'll influence how we secure our customers, help shape the standards we use and have a real say in how the technical team develops.
If you want a narrowly defined role, this probably isn't it. If you enjoy taking a messy tenant and leaving it properly secured, and want to keep building your Microsoft security skills, we'd like to hear from you.
Read more about us or see our accreditations and awards.
Ready to apply?
Send your CV with a short note on a Microsoft 365 tenant you've secured and what you changed.
[email protected]Partner
Essentials
Employer