About the role

Key responsibilities

• Perform routine administration across servers, virtualization (VMware or Hyper-V), cloud workloads, storage, backup and collaboration services, and execute the patch cycle across servers and cloud infrastructure with published currency reporting.
• Operate and maintain the company’s three data centers, and execute the data center consolidation program as it is sequenced.
• Monitor infrastructure health and capacity, respond to alerts, and escalate with useful diagnostic information rather than a restated alert. Take second-level escalation from the service desk on infrastructure issues.
• Execute and evidence backup restore tests on the published schedule, without prompting, and maintain the disaster recovery procedures they support.

• Support the consolidation of all operating companies into a single identity tenant, including mailbox, file and Teams migration.
• Administer Active Directory, Entra ID and hybrid identity, including Group Policy, DNS and DHCP.
• Run the identity lifecycle: joiner, mover and leaver processes that work reliably and produce an audit trail. A departed employee retaining access is a finding in every framework the company is subject to.
• Administer multi-factor authentication, conditional access and privileged access, including the documented, time-limited exception list.
• Maintain role and group design so that access is granted by role rather than by request history.

• Administer Microsoft 365 service configuration and health: Exchange Online, SharePoint Online, OneDrive and Teams.
• Maintain tenant-level security and compliance configuration in partnership with the Manager, Information Security & Compliance, including data loss prevention, retention and audit logging.
• Support the identity and tenant design of a segmented compliance enclave for federal work, built so that it does not force the whole company into a higher-cost, lower-capability tenant.

• Maintain LAN/WAN, firewalls, VPNs, switching and wireless across office locations, as the team’s backup for the network.
• Support secure remote access for hybrid and field staff.
• Manage endpoint protection and device management, and respond to and document security incidents.

• Take second-level escalation from the service desk on hardware, software and workstation issues.
• Support engineering and design applications — Autodesk (AutoCAD, Civil 3D), Bentley, Esri ArcGIS and Bluebeam.
• Image, deploy and retire workstations, CAD workstations, laptops and mobile devices.

• Execute the identity and collaboration workstream on acquisitions: directory assessment, coexistence, migration and cutover.
• Contribute to the identity section of the integration playbook and improve it after each deal.

• Automate provisioning, configuration and reporting rather than performing them by hand.
• Write and maintain runbooks, network diagrams and asset inventory to a standard where a competent peer — or the managed service provider — could operate the system without you present.
• Cross-train with the senior systems engineer so that cover for identity and the network is tested rather than assumed.
• Flag to IT leadership, in writing, any system that only one person can operate.

• Four or more years administering Windows Server, Microsoft 365 and cloud infrastructure, with hands-on patch management, backup, monitoring and physical data center operations, including migration and decommissioning.
• Working command of Entra ID or Active Directory, conditional access and multi-factor authentication.
• Hands-on experience with virtualization (VMware or Hyper-V) and enterprise backup.
• Solid networking fundamentals: TCP/IP, VLANs, DNS, DHCP, firewalls and VPNs.
• Scripting and automation capability — PowerShell at minimum — sufficient to avoid doing repetitive work by hand.
• The discipline to document work to a standard someone else can follow.
• The ability to explain technical issues clearly to non-technical staff.
• A valid driver’s license and the ability to travel to offices and data centers as needed.

Preferred qualifications

• Hands-on involvement in a tenant-to-tenant migration or directory consolidation.
• Experience with government community cloud environments or a segmented compliance enclave.
• Experience supporting federal contract security requirements, such as NIST SP 800-171 or CMMC.
• Experience supporting AEC applications (Autodesk, Bentley, Esri) and high-performance CAD workstations.
• Relevant certification: Microsoft Identity and Access Administrator, Microsoft 365 Administrator Expert, Azure Administrator, CompTIA Network or Security , or CCNA.

Technical capabilities

• Windows Server, Active Directory and group policy; Azure infrastructure administration; VMware or Hyper-V.
• Backup and recovery operations, patch and vulnerability remediation, monitoring and alerting.
• Microsoft Entra ID, hybrid identity, Entra Connect.
• Conditional access, multi-factor authentication, privileged identity management, access reviews.
• Exchange Online, SharePoint Online, OneDrive and Teams administration and migration.
• Migration tooling for tenant-to-tenant work.
• PowerShell, Microsoft Graph and infrastructure automation.
• Microsoft Purview: data loss prevention, retention, audit.
• Networking: firewalls, VPN, switching and wireless; endpoint management with Intune.

How performance is measured

• Patch currency across servers and cloud infrastructure.
• Restore tests completed on schedule, with evidence.
• Data center consolidation milestones delivered.
• Runbook coverage and the result of the most recent cover test.
• Percentage of provisioning performed by automation rather than by hand.
• Time from termination to access revocation, and access review completion.

Working conditions

• Occasional after-hours or weekend work for maintenance windows, migrations and urgent issues; may include an on-call rotation.
• Travel to company offices and data centers as needed.
• Ability to lift up to 50 lbs and work in data centers, server rooms and equipment closets.

Decision rights and escalation