Note: The job is a remote job and is open to candidates in USA. SMX Services & Consulting, Inc. is seeking a Microsoft 365 Security & Governance Consultant to support a Suffolk County Government security and governance initiative. The consultant will independently assess the Microsoft 365 environment, identity and access controls, compliance capabilities, and Active Directory trust relationships, then deliver prioritized security recommendations, remediation roadmaps, knowledge transfer, and executive briefings.
Responsibilities
- Review tenant-wide Microsoft 365 security and governance configurations
- Evaluate global settings, security baselines, administrative roles, and related security controls
- Identify configuration weaknesses, security gaps, and opportunities to strengthen the environment
- Develop practical recommendations to improve the County's Microsoft 365 security posture
- Assess Microsoft Entra ID identity and access configurations
- Review privileged and administrative roles
- Evaluate Multi-Factor Authentication controls
- Assess Conditional Access policies and configurations
- Review Role-Based Access Control and privilege assignments
- Identify excessive privileges and opportunities to strengthen least-privilege access
- Assess Microsoft 365 auditing and logging capabilities
- Review relevant audit logs and monitoring configurations
- Evaluate mailbox auditing
- Review Teams and SharePoint activity visibility
- Identify gaps affecting security monitoring, investigation, and governance
- Provide recommendations for improving the effective use and configuration of these capabilities
- Reviewing relevant forest trust relationships
- Identifying potential security exposure created through trust configurations
- Evaluating potential lateral-access risks
- Identifying opportunities to restrict or segment access
- Recommending improvements that strengthen identity and directory security
- Document identified security and governance gaps
- Assess the potential impact and priority of findings
- Organize recommendations into immediate, medium-term, and longer-term actions
- Identify issues that should be addressed before or in alignment with Microsoft 365 migration activities
- Develop an actionable remediation roadmap for Suffolk County
- Clearly explain technical findings to County stakeholders
- Conduct interactive knowledge-transfer activities
- Present security risks and recommendations in a manner understandable to both technical personnel and leadership
- Support County leadership and security stakeholders in understanding remediation priorities and recommended next steps
- Be willing and able to work remotely
- Provide evidence of a recent background check or agree to a background check performed by Suffolk County Government
- Agree to execute a Suffolk County Government-issued Non-Disclosure Agreement (NDA)
- Protect County information and system-access information obtained during the engagement
Skills
- • Microsoft 365 security architecture
- • Microsoft Entra ID
- • Identity and Access Management
- • Conditional Access
- • Multi-Factor Authentication
- • Privileged access and administrative role management
- • Role-Based Access Control
- • Exchange Online security
- • Microsoft Teams security and governance
- • SharePoint Online security and governance
- • OneDrive security and governance
- • Microsoft Purview or related Microsoft 365 compliance capabilities
- • eDiscovery
- • Data Loss Prevention
- • Retention and information governance
- • Microsoft 365 auditing and security monitoring
- • Active Directory
- • Active Directory forest trusts
- • Security gap assessments
- • Cybersecurity risk analysis
- • Security remediation planning
- Experience performing Microsoft 365 security assessments, tenant reviews, identity-security assessments, Active Directory security reviews, or Microsoft cloud governance engagements is particularly relevant
- • Be willing and able to work remotely
- Candidates should be comfortable producing professional technical and executive-facing materials that may include:
- The successful candidate should be capable of working independently as the primary consultant for the engagement and should be comfortable moving between hands-on technical assessment, cybersecurity analysis, governance recommendations, and executive-level communication
- Strong hands-on knowledge in several of the following areas is highly desirable:
Benefits
- Remote work: all work can be performed remotely
Company Overview