M365 Engineer

About VFX

VFX Financial is one of the UK’s fastest-growing FinTechs, helping complex organisations move, manage, and protect money across borders. Built for specialist sectors, multi-jurisdiction structures, and high-compliance environments, we support businesses whose needs go beyond standard banking. We’re selective about who we work with because exceptional service requires focus and commitment.

With six international offices, five regulatory licences, and an 83% CAGR over the past three years, we’re scaling rapidly and earning industry recognition along the way — including the Financial Times FT1000: Europe’s Fastest Growing Companies 2026, CNBC UK’s Top Fintech Companies 2025, Wealth & Finance FinTech Awards 2026, and the Business Growth Award from Business Awards UK.

Behind it all is a team of ambitious VFXers united by collective ownership, a focus on growth, and a shared passion for solving complex problems.

About the Role

The M365 Engineer owns VFX's Microsoft identity and endpoint environment. The role is weighted as follows: approximately 50% identity security (Entra ID, Conditional Access, PIM), 30% endpoint management and security (Intune, Autopilot, EDR), 10% automation and scripting, and 10% M365 platform support. SharePoint Online, Teams, eDiscovery, and advanced Purview configuration are within scope as secondary responsibilities, not the primary focus.

We use CrowdStrike Falcon for endpoint detection and response, identity threat protection, and security monitoring, alongside our managed SOC operating model. The engineer will work with CrowdStrike tooling in day-to-day operations; full onboarding and training on the CrowdStrike environment is provided. However, this is not a CrowdStrike-specialist role—the core hire will be a strong Microsoft identity and endpoint engineer.

This role can be hybrid at our office in Portimao or fully remote across Portugal.

Key Responsibilities

Identity & Access Management

• Own Entra ID: architecture, user and group lifecycle, hybrid Active Directory integration, and directory governance

• Design, implement, and maintain Conditional Access policies enforcing Zero Trust access principles

• Manage Privileged Identity Management: just-in-time access, role activation workflows, and regular access reviews

• Work with our identity threat detection platform (CrowdStrike Falcon Identity Protection) to monitor for anomalies and respond to identity-based threats — training provided

• Manage external identities, B2B collaboration policies, and cross-tenant access settings

• Own periodic access reviews; ensure IAM controls remain current and evidenced for audit

Endpoint Security & Device Management

• Own the full lifecycle of Windows and mobile device management via Microsoft Intune and Autopilot — provisioning, configuration, compliance, patching, and decommissioning

• Define and enforce device configuration profiles, security baselines, and compliance policies

• Work with our EDR platform (CrowdStrike Falcon) — triage alerts, investigate incidents, and drive remediation alongside the SOC; full training provided

• Manage mobile application management controls to protect corporate data on personal and managed devices

• Monitor endpoint health and security posture; proactively identify and remediate vulnerabilities and configuration drift

Automation & Scripting

• Develop and maintain PowerShell automation for identity lifecycle, compliance remediation, configuration drift detection, and operational self-healing

• Build reusable automation solutions; maintain internal runbooks and operational documentation

M365 Platform Support

• Administer Exchange Online, SharePoint Online, and Microsoft Teams — security configuration, DLP policies, retention labels, and service health

• Manage Microsoft 365 tenant configuration, licensing, and compliance centre settings

• Support data protection requirements — eDiscovery, retention policies, and information protection labels — in collaboration with the DPO

• Lead technical investigation and remediation for M365 platform incidents, working within VFX's incident-management process

Requirements

Essential

• Typically 5+ years in Microsoft cloud, identity, or endpoint engineering, with demonstrable production ownership of Entra ID and Intune

• Deep working knowledge of Entra ID: Conditional Access, PIM, identity governance, hybrid environments

• Hands-on expertise with Microsoft Intune, Autopilot, and MDM/MAM policy management

• Proficiency in PowerShell scripting for identity lifecycle and compliance automation

• Solid understanding of Zero Trust architecture and practical implementation experience

• Experience working with endpoint detection and response tooling in a production environment

• Professional proficiency in English

Preferred

• Experience with CrowdStrike Falcon Identity Protection or equivalent identity threat detection tooling (training provided at VFX)

• Familiarity with SIEM platforms; we use CrowdStrike Falcon LogScale

• Knowledge of NIST or CIS control frameworks applied to identity and endpoint

• Experience with Microsoft Defender products alongside third-party security tooling

• Exposure to GDPR technical controls (e.g. data classification, DLP, eDiscovery) in an M365 environment

• Background in financial services or other regulated sectors

Certifications

• Microsoft Certified: Identity and Access Administrator Associate — SC-300 (strongly preferred)

• Microsoft Certified: Endpoint Administrator Associate — MD-102 (strongly preferred)

• Microsoft Certified: Security Operations Analyst Associate, SC-200 (advantageous)

Benefits at VFX

We offer more than just perks — we offer ownership.

Our benefits include:

• Generous Profit Share Plan (PSP)

• Potential equity opportunities via the Company Share Option Plan (CSOP)

• Competitive salary

• Annual all-expenses paid company incentive trip abroad

• Flexible learning & development budget

PSP & CSOP Details

At VFX, the biggest benefit is the opportunity to act like an owner. Through our Profit Share Scheme (PSP), every team member has a stake in the business by sharing in the profits.

To show you what that looks like, in 2025, PSP participants received over £1,000,000. Historically, VFX has also offered equity opportunities via Company Share Option Plan (CSOP), where more than 80% of eligible VFXers chose to become shareholders — a powerful reflection of the belief and commitment that drives VFX forward.

If you care about building something meaningful, take pride in your work, and are motivated by impact — you’ll thrive here.

Next Steps

If you are successful, you will be contacted for an initial call with our People Ops Team, followed by a 1st stage Teams interview with the hiring manager, with a final Teams interview with the CTO.