Senior IT System Engineer

Who We Are

Karbontürk is a leading company at the forefront of sustainability and environmental solutions, specializing in the activated carbon market. We provide high-quality activated carbon products and services to global corporate clients, delivering solutions across a wide range of industries, including water treatment and purification, air filtration and purification, and food & beverage processes.

Our solutions play a vital role in ensuring safe drinking water, managing wastewater, maintaining industrial and commercial air quality, and enhancing the quality of food and beverages through processes such as sugar refining, oil purification, beverage clarification, and alcohol production. By effectively removing contaminants, odors, and impurities, we help clients achieve operational excellence while supporting environmental sustainability.

At Karbontürk, our mission is to drive innovation, enhance operational efficiency, and contribute to global sustainability efforts. With cutting-edge solutions, technical expertise, and an international perspective, we are committed to setting new industry standards and creating long-term value for our clients worldwide.

We are seeking a Senior IT System Engineer to manage and optimize our Microsoft cloud infrastructure, identity and access management, endpoint security, and enterprise IT systems. The role will focus on Microsoft Intune, Entra ID, Microsoft 365, Purview, Defender XDR, and Microsoft Sentinel, ensuring secure, compliant, and efficient IT operations across the organization. The successful candidate will drive cloud security, digital workplace management, automation, and continuous improvement while supporting the organization's IT infrastructure and cybersecurity requirements.

Qualifications

• Minimum 5 years of total experience in enterprise IT infrastructure.
• Minimum 3 years of hands-on experience managing Windows devices with Microsoft Intune.
• Strong knowledge of Microsoft Entra ID administration, including Dynamic Groups, Conditional Access, Identity Protection, App Registrations, Enterprise Applications, and role-based access control.
• Experience in Microsoft 365 and Exchange Online administration, including active involvement in email migration and cutover projects.
• Hands-on experience implementing Microsoft Purview, including DLP, Endpoint DLP, Insider Risk Management, Retention Policies, and eDiscovery.
• Experience onboarding and managing Microsoft Defender XDR, including Defender for Endpoint and Defender for Office 365.
• Experience deploying and operating Microsoft Sentinel / Log Analytics, including data connectors, KQL queries, analytics rules, and workbooks.
• Strong experience with hybrid IT environments, including on-premises Active Directory and Microsoft Entra ID.
• Hands-on experience with PowerShell, Microsoft Graph PowerShell SDK, Exchange Online PowerShell, PnP PowerShell, and KQL.
• Good understanding of Zero Trust architecture, Conditional Access, MFA, and modern identity and endpoint security practices.
• Knowledge of Windows Server, Active Directory, Group Policy, DNS, TCP/IP, VLANs, site-to-site VPN, certificate management (PKI/SAN), and basic Linux administration.
• Ability to translate KVKK, GDPR, and ISO 27001 requirements into technical security and compliance controls.
• Experience in manufacturing or industrial plant environments, particularly regarding IT/OT separation, is preferred.
• Experience managing a single multi-domain tenant in a multinational structure, particularly Turkey-Germany, is preferred.
• Relevant Microsoft certifications such as MD-102, SC-300, SC-200, SC-401, MS-102, and AZ-104 are preferred.

Computer Skills

• Microsoft Intune: Windows enrollment, Entra Join, Autopilot, Compliance and Configuration Policies, Security Baselines, BitLocker, Windows LAPS, Windows Hello for Business, Windows Update Rings, Win32 and Microsoft 365 Apps deployment, browser management.
• Microsoft Entra ID: Dynamic Groups, Conditional Access, MFA, Authentication Methods, Identity Protection, Password Protection, App Registrations, Enterprise Applications, Graph permissions, Entra Kerberos, and privileged access management.
• Microsoft 365: Exchange Online, SharePoint Online, OneDrive, Microsoft Teams, Universal Print, email flow management, SPF/DKIM/DMARC, and license management.
• Microsoft Purview: Endpoint DLP, Device Control, Insider Risk Management, Activity Explorer, Retention Policies, eDiscovery, and Audit.
• Microsoft Defender XDR: Defender for Endpoint, Attack Surface Reduction (ASR), Controlled Folder Access, EDR, Defender for Office 365, Anti-Phishing, Safe Links, Safe Attachments, incident and alert management, and Advanced Hunting.
• Azure & Microsoft Sentinel: Azure subscription and resource management, Log Analytics, data connectors, KQL, analytics rules, workbooks, automation playbooks, Azure Arc, and Azure Automation Runbooks.
• Scripting & Automation: PowerShell 7, Microsoft Graph PowerShell SDK, Exchange Online PowerShell, PnP PowerShell, and KQL.
• IT Infrastructure: Windows Server, Active Directory, Group Policy, DNS, TCP/IP, VLANs, site-to-site VPN, certificate (PKI/SAN) management, and basic Linux.

Competencies

• Strong analytical and problem-solving skills, with the ability to identify root causes through log, sign-in, and security alert analysis.
• Ability to assess potential impacts before implementing changes, prepare backups, and establish rollback plans.
• A structured and methodical approach to system configuration, testing, verification, and phased deployment.
• Ability to communicate technical topics clearly to management and end users, including multilingual users.
• Strong awareness of KVKK, GDPR, data protection, and privileged access security requirements.
• Ability to manage Microsoft licensing and Azure consumption within budget and evaluate alternative solutions.
• Strong documentation skills, including maintaining technical configurations, procedures, runbooks, decisions, and lessons learned.
• Ability to follow Microsoft platform updates, security developments, and technology deprecation announcements.
• Strong coordination and communication skills when working with internal teams and external service providers.

Responsibilities

Microsoft Intune - Windows Endpoint Management

• Manage Windows device enrollment through Entra Join and Intune, including Autopilot configuration and device naming standards.
• Create, test, and deploy Compliance Policies, Configuration Profiles, and Settings Catalog policies through pilot groups and phased rollouts.
• Manage Windows Security Baselines, BitLocker, Windows Firewall, Windows Hello for Business, and local password policies.
• Control local administrator accounts using Windows LAPS and Accounts CSP.
• Manage Windows Update Rings and Microsoft 365 / Win32 application deployments.
• Configure OneDrive Known Folder Move, Edge/Chrome browser policies, and Trusted Certificate profiles.
• Manage printer deployment through Universal Print and Intune Printer Provisioning.
• Troubleshoot device enrollment failures and monitor device compliance reports.

Microsoft Entra ID - Identity & Access Management

• Manage the user lifecycle, including onboarding and offboarding, account deactivation, and session/token revocation.
• Design and manage license- and service-plan-based Dynamic Groups.
• Implement and manage Conditional Access policies covering legacy authentication, MFA, risky sign-ins, compliant devices, and sign-in frequency.
• Test Conditional Access policies in Report-only mode before production deployment.
• Manage MFA, Authentication Methods, Identity Protection, and Password Protection settings.
• Protect break-glass accounts and manage privileged role assignments based on the principle of least privilege.
• Manage App Registrations, Enterprise Applications, Graph API permissions, and SSO integrations.
• Configure Azure Files authentication with Entra Kerberos.

Microsoft 365

• Manage Exchange Online mailboxes, shared and room mailboxes, distribution lists, and mailbox restoration.
• Manage SPF, DKIM, and DMARC configurations for karbonturk.com and carbomax.de, and troubleshoot email delivery issues using Message Trace.
• Manage SharePoint Online sites, libraries, permission structures, sharing restrictions, and site lifecycle processes.
• Plan and execute OneDrive-SharePoint data migrations.
• Manage Microsoft Teams, Universal Print, email signature solutions, and Microsoft 365 license assignments.
• Govern notifications, Power Automate flows, and integrated applications.

Microsoft Purview - Data Security & Compliance

• Monitor USB and removable storage usage through Endpoint DLP and Device Control in Audit mode.
• Manage Insider Risk Management policies, Collection Policies, thresholds, and related alerts.
• Configure retention policies and labels in accordance with KVKK and ISO 27001 requirements.
• Conduct eDiscovery (Standard) and Audit searches based on documented and authorized requests.
• Prepare and present data leakage risk reports to management using Activity Explorer and analytics.

Microsoft Defender XDR

• Onboard Windows devices to Defender for Endpoint through Intune, GPO, or Security Settings Management.
• Execute the migration from the existing antivirus solution to the Microsoft Defender platform.
• Test Attack Surface Reduction (ASR) rules and Controlled Folder Access in Audit mode before enforcement, ensuring compatibility with industrial software such as CAD/CAM and

PLC applications.

• Manage Defender for Office 365 policies, including Anti-Phishing, Safe Links, and Safe Attachments.
• Investigate security incidents and alerts and perform incident response activities, including device isolation and account containment.
• Establish a single source of authority for each security setting between Intune and Defender.

Azure & Microsoft Sentinel (SIEM)

• Manage Azure subscriptions, resource groups, and associated costs.
• Deploy Log Analytics workspaces and onboard Microsoft Sentinel through the Defender portal.
• Integrate relevant data sources, including Microsoft 365 Audit, Defender XDR alerts, Azure Activity, and Entra ID Protection, while controlling data ingestion costs.
• Develop analytics rules, hunting queries, and workbooks using KQL.
• Correlate Purview and Insider Risk Management signals for security monitoring.
• Define and apply log retention periods in accordance with KVKK and ISO 27001 audit requirements.
• Migrate scheduled PowerShell jobs to Azure Automation Runbooks using Managed Identity.
• Integrate Linux and server resources into security monitoring through Azure Arc.

General Responsibilities

• Apply system and security changes through appropriate change management procedures, pilot testing, and rollback planning.
• Maintain up-to-date technical documentation, system configurations, decisions, and operational procedures.
• Prepare Microsoft licensing and Azure cost analyses and present budget proposals to management.
• Deliver end-user communications and security awareness activities.
• Manage Microsoft support cases and coordinate with external vendors, including DNS/hosting providers and software partners.
• Perform other duties assigned by the IT Manager.

Opportunity Statement

The only criterion evaluated in recruitment and employment is suitability for the job; equal opportunity is provided without any discrimination.