Microsoft 365 Administrator, Level 3 (Part-Time)

Location: Remote (PH) Type: Part-Time **Work Hours:**Between 8 AM - 5 PM Pacific Time Salary: $900 to $1000/Monthly Reports To: CEO

About the Role

RankStudio is hiring a part-time Level 3 Microsoft 365 IT Technician to own architecture and security operations for a growing portfolio of small biotech and pharma client environments. This is a hands-on, senior technical role, not a ticket-support seat. You will design and implement M365 architecture, own security operations end-to-end, and build the automation that keeps client environments compliant and secure. You will work independently under the direction of RankStudio's CEO, who serves as the senior technical advisor across all engagements.

This role is designed for an experienced practitioner with an existing day job, freelance practice, or flexible schedule who wants meaningful architecture work at a boutique AI consulting firm. It is not a full-time seat, and it is not a bridge to full-time employment.

Key Responsibilities

• Architecture - Design Microsoft 365 tenant configurations, security baselines, and compliance postures for biotech and pharma clients across 5-15 client environments. You own the design; the CEO reviews it.
• Security operations - Own vulnerability management, incident response, and security posture monitoring across client tenants. Not alert triage as a ticket-taker, but SecOps as the responsible technician.
• Microsoft Purview architecture - Design and deploy sensitivity labels, DLP policies, retention schedules, eDiscovery workflows, and Insider Risk Management for regulated clients (21 CFR Part 11, HIPAA).
• Entra ID architecture - Design conditional access frameworks, PIM configurations, access review cycles, and identity governance for client tenants.
• Intune deployment architecture - Design BYOD and corporate device management approaches including App Protection Policies for regulated data on personal devices. Deploy compliance policies, configuration profiles, and app management workflows.
• Defender for Endpoint and Defender for O365 - Own policy design, tuning, and incident response ownership. Not queue watching.
• Documentation - Author architecture decision records, runbooks, and configuration baselines that other technicians can operate from.

Required experience

• 4+ years hands-on M365 tenant administration, at least 2 of which in a managed services or multi-tenant consulting context.
• PowerShell scripting from scratch. You can sit down and write a working script for an M365 admin task without starting from a template or AI-generated skeleton. You use documentation and AI tools to accelerate your work, but the underlying capability is yours.
• Hands-on Intune. You have deployed compliance policies, configuration profiles, and App Protection Policies (MAM without enrollment) in production.
• Hands-on Entra ID / Azure AD. You have designed conditional access frameworks, deployed PIM, and run access reviews in production.
• Working Purview knowledge. You have deployed sensitivity labels, DLP policies, or retention schedules in production. Purview forensics-only experience (eDiscovery for hard-deleted data) does not qualify.
• Security operations ownership. You have owned vulnerability remediation, security incident response, or compliance posture for at least one production environment as the responsible technician, not as a ticket-response contributor.
• Excellent written English, with good writing and communication skills.
• Reliable home internet (50 Mbps minimum) and a personal computer capable of running M365 admin centers and a virtual desktop.

Strongly preferred

• Microsoft certifications - MS-102, SC-300, SC-400, AZ-104, AZ-500, MD-102. Full stack not required; two or three genuine, in-date certs are stronger signal than a long list of stale ones.
• PowerShell automation - Comfort writing PowerShell scripts and Microsoft Graph SDK workflows for tenant configuration, user lifecycle, license management, security policy deployment, and compliance reporting. Ability to build automation others will run.
• Infrastructure as code - Experience building repeatable tenant deployments through version-controlled configuration (M365 DSC or comparable approach). Not required if the candidate can demonstrate equivalent discipline through PowerShell-based configuration management.
• Past role at a Microsoft Partner or MSP - Serving SMB or mid-market clients across multiple tenants.
• M365 backup tooling - Veeam M365, AvePoint, Druva, or Spanning.
• Healthcare or life sciences client experience - 21 CFR Part 11, HIPAA, or GxP compliance context.
• Ticketing systems - Freshdesk, Zendesk, ConnectWise, or HaloPSA administration (as the person configuring the tool, not the person filling tickets in it).
• Workflow automation exposure - n8n, Power Automate, or Logic Apps for admin task automation.

Disqualifiers

• Primary career experience is ticket / desk / support work, even if the resume shows M365 admin-center exposure. This role is architecture and SecOps ownership. Section titles matter: "IT Service Desk Analyst," "Technical Support Engineer," "Help Desk Technician" as the dominant career pattern will not fit, regardless of how the current job is titled.
• Cannot write PowerShell without templates or AI-generated skeletons. AI-assisted scripting is expected. Inability to write from scratch is disqualifying, because the role requires building automation others will run.
• No hands-on Intune configuration profile or App Protection Policy deployment. Reading Microsoft Learn on Intune is not the same as deploying it.
• Purview knowledge limited to eDiscovery forensics. The role requires deploying labels, DLP, and retention. Governance, not just search.
• Cannot commit to consistent weekly hours during Pacific business hours overlap. The role is asynchronous but requires reliable availability during the overlap window.

Engagement and pay

• Independent contractor agreement
• 100% Remote
• Part-time commitment: 20 hours per week, flexible scheduling with required overlap during Pacific business hours (specific overlap window to be agreed with the CEO).
• Fixed monthly retainer: USD 900 to 1,000 per month, paid in USD via Wise.

How to apply

• LinkedIn application with profile link
• Short paragraph (under 150 words) describing the largest M365 tenant you have administered (user count, what you owned, what you automated)
• Screenshot or list of any Microsoft certifications, with credential ID
• Two references from past managers or clients (will only be contacted with consent at offer stage)