Principal P&C Platform Architect - M365

This job is with GSK, an inclusive employer and a member of myGwork – the largest global platform for the LGBTQ+ business community. Please do not contact the recruiter directly.

At GSK, we unite science, technology and talent to get ahead of disease together. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together. We’re proud to be leading a healthcare revolution, and we’re looking for people who can help us deliver on our ambition.

Role Overview

Own the architecture of the platform where 50,000+ employees across multiple countries actually do their work — email, files, meetings, chat, intranet, workflow and, increasingly, AI assistance. This role is the definitive technical authority for the Microsoft 365 estate: Exchange Online, SharePoint Online, OneDrive, Teams, Viva, Power Platform, Microsoft 365 Copilot, and the Entra ID and Purview controls that govern them.

Microsoft 365 is no longer a set of applications; it is a tenant-wide platform where an identity decision, a sharing default or a licensing choice propagates instantly to every user and every document. The Principal Platform Architect is accountable for making those decisions deliberately and coherently — balancing collaboration velocity against information protection, and platform capability against cost.

This is a hands‑on‑capable role. The expectation is to build, prove and pressure‑test designs in a lab tenant personally, and to be the person who understands what a setting actually does rather than what the documentation claims.

In this role you will

• Own the target‑state architecture for the M365 tenant: workload topology, tenant and domain strategy, identity and licensing model, data residency, and the integration surface with the wider application estate.
• Define the multi‑year productivity and collaboration roadmap — workload adoption and retirement, migration off legacy platforms (on‑premises Exchange/SharePoint, file shares, third‑party collaboration tools), and consolidation of overlapping tooling.
• Track the Microsoft 365 roadmap and message centre continuously; assess incoming change for risk and opportunity, and decide what the organisation adopts, defers, or disables — before Microsoft decides for you.
• Produce and maintain reference architectures, design patterns and architecture decision records (ADRs) with trade‑offs made explicit.
• Architect information protection across the tenant: Microsoft Purview sensitivity labels, retention and records management, DLP, eDiscovery, insider risk, and Communication Compliance.
• Design the external sharing, guest access and B2B collaboration model — the single most consequential and most frequently mis‑set area of the platform.
• Ensure the tenant meets regulatory obligations: data privacy (GDPR and equivalents), data residency and Multi‑Geo, GxP and validated‑system requirements, records retention, legal hold, and audit/SOX ITGC evidence generation designed in rather than bolted on.
• Partner with Cyber Security on tenant security posture — Conditional Access, Defender for Office 365, Defender for Cloud Apps, Secure Score, token and session controls, and the endpoint's role in tenant trust.
• Own the architecture for Microsoft 365 Copilot and agent platforms: readiness assessment, permission and oversharing remediation, semantic index behaviour, grounding and data boundaries, licensing strategy and measurable value realisation.
• Establish governance for Copilot Studio and agent creation — who may build, on what data, with what review and lifecycle.
• Set the position on AI data handling and prompt/response retention that Legal, Privacy and the Works Council will accept.
• Architect the Power Platform environment strategy: environment topology, data loss prevention policies, connector governance, ALM pipelines, and the boundary between citizen and professional development.
• Design the guardrails that let the business build safely without generating an unmanaged shadow estate.
• Act as design authority for all M365 tenant change; chair or sit on the architecture review board and hold veto on standards deviation.
• Set engineering standards for tenant configuration‑as‑code, change testing, staged rollout and rollback.
• Review supplier and MSP technical designs; ensure partners build to the organisation's architecture, not their own delivery convenience.
• Design for adoption: architect the telemetry that shows what is actually used, and treat low adoption of a funded capability as an architectural or experience defect.
• Own licence architecture and optimisation — SKU mix, add‑on strategy, and defensible cost‑per‑user modelling at 50,000‑user scale, where a single per‑user add‑on is a seven‑figure decision.
• Mentor and technically develop senior engineers and platform leads across the collaboration domain.

Why you?

Basic Qualifications :

We are looking for professionals with these required skills to achieve our goals:

• Bachelor's degree in Computer Science, Engineering or a related technical discipline, or equivalent demonstrable professional expertise.
• Significant experience in IT infrastructure, collaboration or digital workplace technology, including a number of years in a principal, lead or enterprise architect capacity with recognised design authority.
• Architecture ownership for a Microsoft 365 tenant of 20,000+ users across multiple countries and regulatory jurisdictions.
• Expert‑level, hands‑on‑derived command of the core M365 workloads — Exchange Online, SharePoint Online/OneDrive, Teams — and the Entra ID and Purview controls that govern them. Sufficient to build the reference configuration personally, not only to specify it.
• Demonstrable ownership of an enterprise information governance and external sharing model, including the compliance rationale behind it.
• Advanced PowerShell and Microsoft Graph portfolio; evidence of configuration‑as‑code applied to a production tenant.
• Working fluency in M365 security architecture and zero‑trust principles, with a track record of co‑designing controls alongside a Cyber Security function.
• Led the architecture of at least one large‑scale collaboration platform migration or transformation through to production — including what went wrong and what was learned.
• Experience owning or materially influencing a Microsoft licensing position at enterprise scale (EA/MCA), including SKU strategy and cost optimisation.
• Able to produce architecture documentation of a standard that withstands external audit and supplier scrutiny.
• Proven credibility with both senior engineers and executive stakeholders, in English, in a global matrixed organisation.
• Architecture & Implementation experience on MS Copilot and other AI tools.
• Willingness to travel internationally, approximately 5–15% of the time.

Preferred Skills :

If you have the following characteristics, it would be a plus:

• Relevant certifications such as Microsoft 365 Certified: Enterprise Administrator Expert, Cybersecurity Architect Expert, Identity and Access Administrator, Teams Administrator Expert, Power Platform Solution Architect Expert, Information Protection and Compliance Administrator, TOGAF, CISSP.
• Experience in a regulated industry — pharmaceutical, life sciences, biotech, financial services or healthcare — with practical GxP/CSV/CSA, Annex 11 / 21 CFR Part 11, and validated‑collaboration‑system exposure.
• Works Council and employee‑representation engagement in European jurisdictions — particularly around productivity telemetry, Viva Insights and AI features.
• Records management and archiving at enterprise scale, including third‑party archive platforms and journaling.
• Teams Phone / voice architecture — Direct Routing, Operator Connect, PSTN migration from legacy telephony.
• Viva suite architecture — Connections, Engage, Learning, Insights — including the privacy design that makes Insights acceptable.
• Leading a major platform transformation: on‑premises to cloud migration, tenant consolidation, or M&A integration/divestment of an M365 tenant.
• Third‑party collaboration platform rationalisation — Slack, Zoom, Google Workspace, Box, Dropbox coexistence or retirement.
• Enterprise application integration — SaaS integration patterns with M365, iPaaS, API management, and the identity implications of each.
• Accessibility designed into the collaboration experience rather than remediated after complaint.
• FinOps for SaaS — licence optimisation, chargeback/showback models, and true‑up negotiation support.
• Contribution to the wider community — open‑source tooling, conference speaking, published technical writing, Microsoft customer advisory boards or MVP status.

Other Job-Related Skills/Background:

• Deep technical breadth across the M365 workload estate and the Entra ID / Purview controls that govern it, with the judgment to know where tenant‑wide standardisation matters and where a business exception is defensible.
• Advanced PowerShell and Microsoft Graph API fluency — including delta queries, permissions and app‑only auth patterns — plus at least one general‑purpose language (Python, C#) applied to real automation.
• Telemetry and reporting craft — M365 usage analytics, Graph Data Connect, Log Analytics/KQL, Power BI — designing measurement into the platform from day one.
• Architectural discipline — reference designs, ADRs, HLD/LLD, written clearly enough that engineers can build from them and external auditors can accept them.
• Trade‑off reasoning — collaboration velocity vs. information risk, capability vs. licence cost, standardisation vs. business exception; comfortable quantifying the uncomfortable option.
• Scale intuition — designing for 50,000 users, terabyte‑scale content estates, tenant‑wide blast radius, and the long tail of exceptions that always exists.
• Technical leadership without authority — landing decisions across engineering, security, legal, privacy, HR and vendors through credibility and evidence.
• Executive communication — making platform architecture legible and decision‑ready for non‑technical leadership.
• Constructive challenge — able to disagree with a Director, Microsoft, or a security architect and keep the relationship intact.

Closing Date for Applications: Sunday 1st November 2026 (COB)

Please take a copy of the Job Description, as this will not be available post closure of the advert.

#LI-GSK

#LI-Hybrid

#AGTech

Skills

Cloud Computing, Container Orchestration, Data Center Management, DevOps, Disaster Recovery (DR), Identity Access Management (IAM), Information Technology (IT) Risk Management, Integration Platform as a Service (iPaaS), Network Design, Serverless Platforms, Service Oriented Architecture (SOA), Storage Area Network (SAN),