IT Operations Principal (M365 Engineer)

Most Microsoft 365 jobs are about keeping the lights on. This one is about turning the lights off - on the manual work, at least. We are looking for an engineer who treats every repetitive ticket as a bug in the system, and who works with the team to fix the system.

You will share ownership of the platform our company works in every day - Exchange, Entra ID, Teams, and increasingly Microsoft 365 Copilot - alongside the rest of Technology Operations. Keeping it healthy is the baseline. The actual job is making it require less human intervention each quarter than it did the last - through automation, better defaults, and self-service that people genuinely prefer over opening a ticket.

This role suits someone who genuinely enjoys IT operations and the Microsoft platform, and who wants to spend their time working across the business - with security, compliance, the service desk, and the teams we support - to make the organization more efficient and better prepared. The measure of success here is business value: hours given back to the people we support, risk reduced, and costs avoided - delivered with a service mindset that treats every colleague as a customer whose time matters.

What You'll Actually Do

Automate the toil away

• Kill the repeat tickets - when the same request shows up for the third time, you and the service desk decide it is worth automating, and you build the fix instead of closing tickets faster. Power Automate, PowerShell, Microsoft Graph, Logic Apps - whatever fits.
• Build self-service - access requests, group management, and common fixes that users can resolve without waiting on IT.
• Measure what you removed - we care about the tickets that stopped happening, not the ones you closed quickly.
• Get Copilot ready - permissions hygiene, oversharing remediation, and sensitivity labeling with security and compliance, then agents and pilots where a team has a real problem worth solving.

Treat the tenant like a platform

• Configuration as code - tenant changes should live in version control and go through peer review, not in someone's memory of what they clicked.
• Ship changes safely - test, roll out deliberately, and be able to roll back. Change management as engineering practice, not paperwork.
• Documentation and roadmap - runbooks and notes people actually trust.

Keep the core solid

The forward-looking work only earns trust if the fundamentals hold, and the people we support feel well served day by day. A meaningful share of the role is still hands-on operations:

• Exchange Online and Entra ID operations - mail flow, connectors, transport rules, and email authentication (SPF, DKIM, DMARC); Conditional Access, MFA and passwordless rollouts, SSO integrations, directory sync, and privileged access.
• Tier-3 escalation for M365 issues - root cause analysis that produces a permanent fix - plus a shared on-call rotation and occasional maintenance windows.

We care more about how you think than about the exact boxes you tick. If you meet most of this and are genuinely interested in the rest, apply.

• You've run M365 in production - roughly 3-5 years administering a real tenant with real users, including Exchange Online and Entra ID.
• You script by default - PowerShell is your reflex, and you have used Microsoft Graph to do things the admin portals cannot.
• You debug to root cause - authentication failures, mail delivery problems, and sync errors get investigated - and what you find gets written up and shared, not just restarted.
• You're already curious about Copilot - whether through hands-on admin work, building agents, or serious self-directed learning.
• You write well - clear documentation and plain-language explanations for non-technical colleagues. This matters more on a remote team.
• You work well with others - comfortable partnering across IT and the business, strong at asynchronous communication, and calm when something breaks at an inconvenient hour.
• You lead with service - you treat colleagues as customers, communicate clearly while an issue is open, follow through past the point where the ticket closes, and use what you hear from them to decide what to fix next.
• You connect work to outcomes - you can explain what a project saves, prevents, or enables in terms the business recognizes, and you prioritize accordingly.

Bonus Points

• Hands-on work with Copilot Studio, declarative agents, or Graph connectors.
• Infrastructure-as-code experience (Bicep, Terraform, Azure Automation) or CI/CD applied to tenant configuration.
• Defender for Office 365 or Defender for Identity.
• Hybrid Exchange or migration experience, including tenant-to-tenant moves.
• Certifications such as MS-102, SC-300, or AZ-104 - useful signal, not a requirement.
• Experience in a regulated environment with formal audit requirements.

Working Here

• Fully remote, with a preference for candidates in the Eastern or Central time zone so there is real overlap with the team.
• Less than 25% travel for occasional team meetings and site visits.
• On-call rotation shared across the team - nobody carries it alone.
• Education: a degree in a technical field is welcome, and equivalent hands-on experience is equally welcome.

Why work for Cornerstone Building Brands?

Our teams are at the heart of our purpose to positively contribute to the communities where we live, work and play. Full-time* team members receive** medical, dental and vision benefits starting day 1. Other benefits include PTO, paid holidays, FSA, life insurance, LTD, STD, 401k, EAP, discount programs, tuition reimbursement, training, and professional development.

*Full-time is defined as regularly working 30+ hours per week.**Union programs may vary depending on the collective bargaining agreement

All your information will be kept confidential according to EEO guidelines

Note: Disclosure as required by sb19-085 (8-5-20), sb293 (BDR 53-907), and NYCHRL salary (or hourly wage) compensation for this role when being hired into our Colorado or Nevada office or as a remote or virtual Colorado, Nevada, or New York City based employee.

Why work for Cornerstone Building Brands?

Our teams are at the heart of our purpose to positively contribute to the communities where welive, work and play. Full-time* team members receive** medical, dental and vision benefits starting day 1. Other benefits include PTO, paid holidays, FSA, life insurance, LTD, STD, 401k, EAP, discount programs, tuition reimbursement, training, and professional development.

*Full-time is defined as regularly working 30+ hours per week. **Union programs may vary depending on the collective bargaining agreement.

Cornerstone Building Brands is an Equal Opportunity Employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, or status as a protected veteran. You can find the Equal Employment Opportunity Poster here. You can also view Your Right to Work Poster herealong with This Organizations Participation in E-Verify Poster here.If you'd like to view a copy of the company's affirmative action planfor protected veterans or individuals with disabilities or policy statement, please contact Human Resources at 281-897-7788 or HRCompliance@cornerstone-bb.com. If you have a disability and you believe that you need a reasonable accommodation in order to search for a job opening or to submit an online application, please contact Human Resources at 281-897-7788 or HRCompliance@cornerstone-bb.com. This email is used exclusively to assist disabled job seekers whose disability prevents them from being able to apply online. Only emails received for this purpose will be returned. Messages left for other purposes, such as following up on an application or technical issues not related to a disability, will not receive a response.

All your information will be kept confidential according to EEO guidelines.

California Consumer Privacy Act (CCPA) of 2018

Must be at least 18 years of age to apply.

Note to External Recruiters

Cornerstone Building Brands does not accept unsolicited resumes and will not pay fees for any candidate submissions that were not expressly authorized.

Notice of Recruitment Fraud

We have been made aware of multiple scams whereby unauthorized individuals are using Cornerstone Building Brand's name and logo to solicit potential job-seekers for employment. In some cases, job-seekers are being contacted directly, both by phone and e-mail. In other instances, these unauthorized individuals are placing advertisements for fake positions with both legitimate websites and fabricated ones. These individuals are typically promising high-paying jobs with the requirement that the job-seeker send money to pay for things such as visa applications or processing fees. Please be advised that Cornerstone Building Brands will never ask potential job-seekers for any sort of advance payment or bank account information as part of the recruiting or hiring process.