Principal P&C Platform Architect - M365
GSK · United Kingdom, London, New Oxford Street
At GSK, we unite science, technology and talent to get ahead of disease together. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together. We’re proud to be leading a healthcare revolution, and we’re looking for people who can help us deliver on our ambition.
Role Overview
Own the architecture of the platform where 50,000+ employees across multiple countries actually do their work — email, files, meetings, chat, intranet, workflow and, increasingly, AI assistance. This role is the definitive technical authority for the Microsoft 365 estate: Exchange Online, SharePoint Online, OneDrive, Teams, Viva, Power Platform, Microsoft 365 Copilot, and the Entra ID and Purview controls that govern them.
Microsoft 365 is no longer a set of applications; it is a tenant-wide platform where an identity decision, a sharing default or a licensing choice propagates instantly to every user and every document. The Principal Platform Architect is accountable for making those decisions deliberately and coherently — balancing collaboration velocity against information protection, and platform capability against cost.
This is a hands-on-capable role. The expectation is to build, prove and pressure-test designs in a lab tenant personally, and to be the person who understands what a setting actually does rather than what the documentation claims.
In this role you will
- Own the target-state architecture for the M365 tenant: workload topology, tenant and domain strategy, identity and licensing model, data residency, and the integration surface with the wider application estate.
- Define the multi-year productivity and collaboration roadmap — workload adoption and retirement, migration off legacy platforms (on-premises Exchange/SharePoint, file shares, third-party collaboration tools), and consolidation of overlapping tooling.
- Track the Microsoft 365 roadmap and message centre continuously; assess incoming change for risk and opportunity, and decide what the organisation adopts, defers, or disables — before Microsoft decides for you.
- Produce and maintain reference architectures, design patterns and architecture decision records (ADRs) with trade-offs made explicit.
- Architect information protection across the tenant: Microsoft Purview sensitivity labels, retention and records management, DLP, eDiscovery, insider risk, and Communication Compliance.
- Design the external sharing, guest access and B2B collaboration model — the single most consequential and most frequently mis-set area of the platform.
- Ensure the tenant meets regulatory obligations: data privacy (GDPR and equivalents), data residency and Multi-Geo, GxP and validated-system requirements, records retention, legal hold, and audit/SOX ITGC evidence generation designed in rather than bolted on.
- Partner with Cyber Security on tenant security posture — Conditional Access, Defender for Office 365, Defender for Cloud Apps, Secure Score, token and session controls, and the endpoint's role in tenant trust.
- Own the architecture for Microsoft 365 Copilot and agent platforms: readiness assessment, permission and oversharing remediation, semantic index behaviour, grounding and data boundaries, licensing strategy and measurable value realisation.
- Establish governance for Copilot Studio and agent creation — who may build, on what data, with what review and lifecycle.
- Set the position on AI data handling and prompt/response retention that Legal, Privacy and the Works Council will accept.
- Architect the Power Platform environment strategy: environment topology, data loss prevention policies, connector governance, ALM pipelines, and the boundary between citizen and professional development.
- Design the guardrails that let the business build safely without generating an unmanaged shadow estate.
- Act as design authority for all M365 tenant change; chair or sit on the architecture review board and hold veto on standards deviation.
- Set engineering standards for tenant configuration-as-code, change testing, staged rollout and rollback.
- Review supplier and MSP technical designs; ensure partners build to the organisation's architecture, not their own delivery convenience.
- Design for adoption: architect the telemetry that shows what is actually used, and treat low adoption of a funded capability as an architectural or experience defect.
- Own licence architecture and optimisation — SKU mix, add-on strategy, and defensible cost-per-user modelling at 50,000-user scale, where a single per-user add-on is a seven-figure decision.
- Mentor and technically develop senior engineers and platform leads across the collaboration domain.
Why you?
Basic Qualifications:
We are looking for professionals with these required skills to achieve our goals:
- Bachelor's degree in Computer Science, Engineering or a related technical discipline, or equivalent demonstrable professional expertise.
- Significant experience in IT infrastructure, collaboration or digital workplace technology, including a number of years in a principal, lead or enterprise architect capacity with recognised design authority.
- Architecture ownership for a Microsoft 365 tenant of 20,000+ users across multiple countries and regulatory jurisdictions.
- Expert-level, hands-on-derived command of the core M365 workloads — Exchange Online, SharePoint Online/OneDrive, Teams — and the Entra ID and Purview controls that govern them. Sufficient to build the reference configuration personally, not only to specify it.
- Demonstrable ownership of an enterprise information governance and external sharing model, including the compliance rationale behind it.
- Advanced PowerShell and Microsoft Graph portfolio; evidence of configuration-as-code applied to a production tenant.
- Working fluency in M365 security architecture and zero-trust principles, with a track record of co-designing controls alongside a Cyber Security function.
- Led the architecture of at least one large-scale collaboration platform migration or transformation through to production — including what went wrong and what was learned.
- Experience owning or materially influencing a Microsoft licensing position at enterprise scale (EA/MCA), including SKU strategy and cost optimisation.
- Able to produce architecture documentation of a standard that withstands external audit and supplier scrutiny.
- Proven credibility with both senior engineers and executive stakeholders, in English, in a global matrixed organisation.
- Willingness to travel internationally, approximately 5–15% of the time.
Preferred Skills:
If you have the following characteristics, it would be a plus:
- Relevant certifications such as Microsoft 365 Certified: Enterprise Administrator Expert, Cybersecurity Architect Expert, Identity and Access Administrator, Teams Administrator Expert, Power Platform Solution Architect Expert, Information Protection and Compliance Administrator, TOGAF, CISSP.
- Experience in a regulated industry — pharmaceutical, life sciences, biotech, financial services or healthcare — with practical GxP/CSV/CSA, Annex 11 / 21 CFR Part 11, and validated-collaboration-system exposure.
- Works Council and employee-representation engagement in European jurisdictions — particularly around productivity telemetry, Viva Insights and AI features.
- Records management and archiving at enterprise scale, including third-party archive platforms and journaling.
- Teams Phone / voice architecture — Direct Routing, Operator Connect, PSTN migration from legacy telephony.
- Viva suite architecture — Connections, Engage, Learning, Insights — including the privacy design that makes Insights acceptable.
- Leading a major platform transformation: on-premises to cloud migration, tenant consolidation, or M&A integration/divestment of an M365 tenant.
- Third-party collaboration platform rationalisation