Qualification:

Any Degree or equivalent experience.

Certification (any of the following preferred):

- Microsoft SC-300 (Identity and Access Administrator) and/or SC-200 (Security Operations Analyst) and/or AZ-500 (Azure Security Engineer)

- MCSE: Server Infrastructure, or MCM/MCA in Directory Services, or equivalent hands-on experience

- Firewall/network security certification (e.g., PCNSE, Fortinet NSE, or CCNP Security) is a plus

Role Requirement:

- Strong understanding of IT infrastructure, network hardware, and enterprise security architecture.

- Must have very good working knowledge of the Microsoft 365 / Azure (Entra ID) platform end-to-end, including Microsoft Defender for Cloud Apps and Defender for Endpoint; AWS knowledge is an added advantage.

- Good understanding of core networking concepts (VLANs, layer 2/3 routing, access lists, load balancing) and hands-on experience administering enterprise firewalls (rule management, VPN, NAT, segmentation).

- Ability to think through problems and design solutions across hybrid, cross-platform environments (Windows and macOS); ability to implement, administer, and troubleshoot end-to-end.

- Automate manual processes using AI tools wherever possible, to improve troubleshooting, documentation, and day-to-day infrastructure operations.

Job Requirements:

Identity & Hybrid Directory Services:

- Designing, planning, migrating, and implementing Active Directory in environments with 2,500+ users.

- Designing, implementing, and troubleshooting Directory Synchronization and Federation Services (Azure AD Connect / Cloud Sync, ADFS) for Microsoft Entra ID (Azure AD).

- Managing Microsoft Entra ID (Azure AD) services including users, groups, device management, Enterprise Applications, App Registrations, and Conditional Access.

- Configuring SSO (SAML, OAuth2/OIDC) integrations and API/App Registrations, including service principals, API permission scopes, and certificate/secret-based authentication.

- DNS/DHCP and Group Policy design.

- Hands-on experience managing DNS records (A, CNAME, MX, TXT, including SPF/DKIM/DMARC) across internal and external DNS zones.

- Designing on-premises AD with Hybrid Azure AD Sync.

- Active Directory hands-on experience in multi-site / multi-domain / multi-forest environments.

- Deep knowledge of Active Directory and Entra ID, including Group Policy, Federation, and Single Sign-On.

- Strong experience with AD enterprise certificate services, rights management server, AD Federation Services, and identity manager.

- Experience with Active Directory consolidation/migration (Quest migration experience and ADMT a plus) and running AD health checks.

- Strong experience with IP Address Management (IPAM) solutions.

Cloud & Endpoint Security (Microsoft Defender Suite):

- Hands-on experience with Microsoft Defender for Cloud Apps (CASB) policy creation, OAuth app governance, shadow IT / cloud app discovery.

- Hands-on experience with Microsoft Defender for Endpoint, device onboarding, EDR, attack surface reduction, vulnerability management.

- Working knowledge of Defender for Identity and/or Microsoft Sentinel is a plus.

- Hands-on experience with email security solutions such as Microsoft Defender for Office 365 or similar anti-phishing, anti-spam, safe links/attachments, and mail flow security.

- O365 security and compliance administration.

Endpoint Management - Windows & Mac:

- Hands-on experience with O365, Intune, and MDM for Windows endpoints.

- Hands-on experience managing macOS/Apple devices using Kandji, Jamf, or a similar Apple MDM, including Apple Business Manager and Automated Device Enrollment.

- Hands-on experience handling servers such as Windows Server 2012, 2016, 2019, and 2022.

- Cross-platform patching, security, performance, and backup/recovery best practices across Windows and macOS.

Network & Firewall:

- Strong experience with core networking (VLANs, layer 2/3 routing, ACLs, load balancing).

- Hands-on administration of enterprise firewalls, including rule management, site-to-site and remote-access VPN, NAT, and network segmentation.

- Working knowledge of SD-WAN technologies and ISP/circuit concepts (MPLS, broadband, leased lines, last-mile connectivity, failover and redundancy).

- Working knowledge of Zero Trust Network Access (ZTNA) solutions such as FortiClient EMS or Zscaler, or similar.

- Working knowledge of NaaS (Network as a Service), enterprise WiFi/Access Point management, and RADIUS-based authentication (802.1X).

Collaboration & Meeting Room Technology:

- Hands-on experience managing meeting room/conferencing platforms such as Cisco (Webex Room devices), Microsoft Teams Rooms, and Zoom Rooms.

- Configuring and managing collaboration hardware from Logitech and Cisco (room cameras, speakers, controllers) across meeting spaces.

- Willing to partner with internal teams (facilities, events, business stakeholders) to plan and support large town halls and company-wide gatherings, including AV setup and live event support.

Cloud Infrastructure, Virtualization & VDI:

- Proven experience with Virtualization, Storage, Compute, Cloud (Azure), Network, Backups, and Automation/Scripting (PowerShell).

- Hands-on experience with backup and disaster recovery solutions such as Veeam or similar, covering Microsoft 365, virtual machines/servers, and cloud workloads.

- Experience creating and maintaining documentation for the Azure VDI environment, including architecture diagrams, configuration guides, and standard operating procedures.

- Managing and maintaining the Azure VDI environment, including monitoring, troubleshooting, performance optimization, and security.

- Staying current with industry trends and best practices in VDI and cloud computing, and applying them to improve the environment.

Technical Leadership & Escalation:

- Own end-to-end technical direction and standards across identity, cloud, endpoint, and network/security domains - not execution within a single domain only.

- Define and maintain standards for Conditional Access, CASB policy, EDR/MDM enrollment, and firewall change management.

- Evaluate and recommend tools and vendors (e.g., MDM platform selection, CASB/EDR tooling, firewall vendor).

- Act as the technical escalation point for complex, cross-domain incidents beyond L2/L3 support; mentor and guide L1 - L3 engineers.

- Work closely with other IT and security teams to ensure identity, endpoint, and network systems are integrated with other systems and applications.

- Partner with security, risk, and compliance teams (e.g., ISO 27001/SOC 2, as applicable) on identity and endpoint controls.

- Ready to collaborate with teams across different regions, understanding their business needs and driving them through to a solution.

- Present technical recommendations, risk assessments, and plans to IT leadership and other stakeholders.

- Own disaster recovery / business continuity planning for identity, directory, and endpoint management platforms.

- Knowledge of AWS is an added advantage.