Entra/M365 IaC Engineer
Duration: 13+ Months Location: MA-Waltham, 100% Remote Overview: Every Turnberry consultant belongs to a practice, an internal group of consultants and leaders with shared experience and expertise. Each of these practices aligns to one of the core services Turnberry offers to clients. As an Entra/M365 IaC Engineer, you will join Turnberry's Digital Modernization practice, where technology and strategy combine to deliver exceptional digital experiences, empowering organizations to thrive in today's digital market.
Responsibilities
Tenant Configuration and Deployment Design and implement repeatable Microsoft Entra ID/Microsoft 365 configuration deployment across existing and newly provisioned tenants Export, document, normalize, and version-control approved settings using Microsoft365DSC and relevant Microsoft Graph interfaces Automate supported configurations for Conditional Access, authentication methods, administrative roles, PIM, enterprise applications, security groups, and other identity controls Account for tenant-specific identifiers, service principals, licensing, and dependencies while keeping reusable configuration templates portable IaC Engineering and CI/CD Build PowerShell-based workflows and declarative configurations using Microsoft365DSC, Microsoft Graph, and complementary automation tooling Implement source-controlled repositories and Azure DevOps or GitHub Actions pipelines with pull requests, testing, approvals, and release controls Use least-privilege automation identities, certificate-based authentication or managed identities where supported; protect credentials and secrets Implement deployment validation, error handling, idempotency checks, configuration recovery, and rollback plans appropriate to each resource Configuration Governance and Operationalization Implement regular tenant configuration comparison, drift detection and actionable reporting; assess Microsoft Graph TCM capabilities for snapshots and monitoring where supported Produce configuration evidence and change history appropriate for a regulated pharmaceutical environment Troubleshoot DSC module dependencies, authentication and Graph permissions, API limitations, unsupported resource types, and deployment failures Create runbooks, architecture documentation, testing procedures, and knowledge-transfer materials for the internal IAM team
Qualifications
Production hands-on experience using Microsoft365DSC to export and manage Microsoft Entra ID or Microsoft 365 tenant configurations, including applying configuration changes Practical experience automating Entra tenant settings with PowerShell, Microsoft Graph API and Microsoft Graph PowerShell SDK Experience developing Git-based IaC workflows and CI/CD pipelines with Azure DevOps or GitHub Actions Strong knowledge of Entra ID security and governance: Conditional Access, PIM, RBAC, authentication methods, enterprise applications, and service principals Ability to demonstrate tenant deployment or configuration promotion across environments, including dependency handling and post-deployment validation Ability to work independently, document technical decisions, and deliver operational solutions rather than proof-of-concept scripts
Preferred Qualifications
Experience with Microsoft Graph Tenant Configuration Management (TCM) APIs, configuration snapshots, and configuration drift monitoring Experience with Microsoft Intune and Microsoft 365 security workload configuration automation Experience with Entra Identity Governance, Entitlement Management, Access Reviews, and Lifecycle Workflows Complementary use of Terraform/Bicep for Azure infrastructure, alongside tenant-specific Microsoft 365 configuration tooling Experience supporting SOX, GxP or other regulated change-control and audit environments The salary range for this role is $130,000 to $185,000 or the hourly equivalent. Pay is based on several factors including but not limited to education, work experience, certifications, etc. In addition to your salary, Turnberry Solutions offers benefits such as a comprehensive healthcare package (medical, dental, vision), disability and group term life insurance, health and flexible spending accounts, a utilization bonus, 401(k) with match, flexible time off for salaried employees, parental leave for salaried employees, and flexible work arrangements (all benefits are subject to eligibility requirements). No matter where or when you begin a career with Turnberry, you'll find a far-reaching choice of benefits and incentives. At Turnberry, we are committed to creating a positive and connected work environment for all and are fully invested in and focused on hiring and growing a diverse team of high performers. We believe that uniqueness in ideas, experiences, and backgrounds make us a better Turnberry: Turnberry is an Equal Employment Opportunity employer, and recruits, employs, trains, compensates, and promotes regardless of age, ancestry, family medical or genetic information, gender identity and expression, marital, military, or veteran status; national and ethnic origin; physical or mental disability; political affiliation; pregnancy; race; religion; sex; sexual orientation; and any other protected characteristics. Americans With Disabilities Act (ADA) Turnberry will provide reasonable accommodation with our application process upon request as required to comply with applicable laws. If you have a disability and require accommodation assistance in this application process, please send an email to our Human Resources department at [email protected] .