Manager, Datacenter Operations

Overview A global biopharmaceutical company on a mission to Solve On, Incyte follows science to find solutions for patients with unmet medical needs. Through the discovery, development, and commercialization of proprietary therapeutics, Incyte has established a portfolio of first-in-class medicines for patients and a strong pipeline of products in Hematology, Oncology and Inflammation and Autoimmunity Headquartered in Wilmington, Delaware, Incyte has operations in North America, Europe, and Asia. Role Summary The Manager, Microsoft Cloud Services is accountable for the strategy, architecture, governance, security, lifecycle, financial stewardship, and engineering direction of the organization's Microsoft cloud environment, including Microsoft Azure, Microsoft Intune, Microsoft Entra ID, Exchange Online, and core Microsoft 365 tenant services. This technical management role leads a small team, establishes platform standards, makes architecture decisions, and ensures the environment is secure, scalable, resilient, compliant, cost-effective, and aligned with business priorities. The role owns platform strategy and the control plane rather than routine infrastructure operations. Standard activities such as individual server deployments, daily monitoring, backup execution, routine patching, and first-line operational support are performed by Infrastructure Operations or managed service providers. The Manager defines the architecture, guardrails, service expectations, and governance under which those teams operate and provides senior technical escalation for platform-wide issues and risk decisions. SharePoint Online, Microsoft Teams, Power Apps, Power Automate, and the broader Power Platform suite are outside the scope of this role and are owned by separate service teams. Key Responsibilities Azure Platform Strategy & Architecture 1. Own the Azure strategy and roadmap and translate business, security, compliance, and infrastructure requirements into a prioritized platform plan. 2. Define and govern the Azure enterprise architecture, including management groups, subscriptions, landing zones, resource organization, naming and tagging, Azure Policy, RBAC, shared services, connectivity, DNS, private endpoints, logging architecture, and hybrid integration. 3. Serve as the senior technical authority for cloud service selection, architecture patterns, resilience, workload placement, integration, and modernization decisions. 4. Review and approve significant Azure designs and exceptions to ensure alignment with enterprise architecture, cybersecurity, regulatory, supportability, and cost requirements. 5. Establish reusable reference architectures and engineering standards that enable secure, consistent, and efficient cloud adoption. Microsoft Intune & Endpoint Management 1. Oversees the Intune strategy, architecture, and governance, of the Intune platform and conditional access policies. 2. Define standards for securing the Intune platform working with IT Security and Microsoft to understand the platform roadmap. 3. Provide technical direction to endpoint operations teams and End User servers. Excluding routine device support, software fulfillment, and day-to-day 4. endpoint administration from this role. Microsoft Entra ID & Identity Governance 1. Own the Entra ID architecture and governance model for workforce identities, guest identities, privileged identities, enterprise applications, application registrations, service principals, and managed identities. 2. Define and govern identity security controls, including Conditional Access, multifactor authentication, passwordless authentication, Privileged Identity Management, Identity Protection, access reviews, and entitlement management. 3. Direct identity lifecycle engineering for joiner, mover, and leaver processes, automated provisioning and deprovisioning, role-based access, group governance, and integration with authoritati e systems. 4. Establish application authentication and authorization standards for SAML, OpenID Connect, OAuth, certificates, secrets, API permissions, consent, and workload identities. 5. Ensure privileged access is controlled, reviewed, monitored, and auditable using least privilege and segregation-of-duties principles. Microsoft 365 Core Services 1. Provide platform ownership for Microsoft 365 tenant administration, including tenant configuration, administrative roles, domain management, service-health governance, licensing, and cross-service dependencies within the defined scope. 2. Own the Exchange Online strategy and architecture, including mail flow, accepted domains, connectors, transport controls, authentication, hybrid dependencies, retention alignment, and third-party email security integration. 3. Lead major tenant and messaging initiatives, including migrations, acquisitions, domain changes, service consolidations, security enhancements, and platform lifecycle activities. 4. Monitor Microsoft roadmaps, advisories, and service changes and coordinate impact assessments, testing, communications, and adoption planning for in-scope services. 5. Maintain clear service boundaries with the owners of SharePoint Online, Microsoft Teams, Power Apps, Power Automate, and the Power Platform suite. Security, Compliance, Risk & Resilience 1. Maintain the Microsoft cloud security baseline in partnership with Cybersecurity through policy, secure configuration standards, identity controls, encryption, key management, centralized logging, and posture assessment. 2. Own remediation plans for platform-level findings from audits, risk assessments, configuration reviews, penetration tests, and internal control evaluations. 3. Define resilience and continuity requirements, including regional strategy, recovery objectives, configuration recovery, dependency mapping, emergency access, and service continuity procedures. 4. Ensure architecture decisions and controls are documented and auditable through current standards, diagrams, decision records, control evidence, exception approvals, and lifecycle documentation. Governance, Automation & Financial Management Establish platform guardrails using Azure Policy, RBAC, privileged workflows, resource locks, tagging, budgets, quotas, approved service catalogs, and automated compliance checks. Drive infrastructure-as-code and policy-as-code adoption using approved tools such as Bicep, Terraform, PowerShell, Microsoft Graph, Azure DevOps, or GitHub-based pipelines. Own cloud financial governance, including cost allocation, forecasting, showback or chargeback support, reservations, savings plans, licensing optimization, consumption analysis, and waste reduction. Maintain a platform lifecycle and technical-debt plan covering unsupported configurations, legacy authentication, expiring credentials, deprecated services, policy exceptions, and modernization priorities.