Level 3 Support Engineer (MSP)

Head Office

Corporate

Full Time

Starting ASAP

Job description

We need people who have done the work, not watched it. This is a hands-on engineering role. We are looking for people who have personally built, configured, migrated and fixed systems in live production environments, with their own hands on the keyboard and their name on the change. If most of your experience has come from working alongside senior engineers, shadowing projects, or escalating to someone else to make the fix, this role is not the right fit yet. That is not a knock on anyone. It is simply what this role needs. We also need a people person. You will be in front of customers every week, on site and on the phone, and they need to trust you and enjoy dealing with you. We want someone with a great personality who can relate to customers, explain things in plain English and build real relationships. We are not looking for a back-end boffin who would rather not talk to anyone. In the interview we will ask you to walk us through real work you have delivered: what the environment looked like, what you changed, what went wrong and how you fixed it. You will then sit multiple practical tests across the core technologies in this role. They are hands-on, they are not multiple choice, and they cannot be passed on theory. If you have done the work, you will enjoy them. If you have not, they will show it quickly. The Level 3 Support Engineer is the senior technical escalation point for the Managed Services service desk. You will resolve the complex, high-impact and unresolved issues that L1 and L2 cannot, own technical changes and small to medium projects in client production environments, and raise the technical standard of the team through documentation, automation and mentoring. Success in this role means client environments that are stable, secure and well documented, fewer repeat incidents, and a service desk that escalates less over time because you have fixed the root cause and taught the team how. Escalation and incident resolution Act as the final technical escalation point for incidents and problems across Microsoft 365, Azure, on-premises infrastructure, networking and security. Lead the technical response to major incidents and P1 outages, including client communication alongside the service delivery team. Carry out root cause analysis and implement permanent fixes, not workarounds. Resolve tickets within SLA and keep HaloPSA records accurate, complete and useful to the next engineer. Change, project and build work Plan, test and execute changes in live client environments, including change documentation, rollback plans and post-change validation. Deliver small to medium technical projects such as tenant migrations, Intune and Autopilot rollouts, server upgrades, firewall replacements, Azure workloads and security hardening. Build and configure new client environments to PB Tech standards during onboarding. Security and compliance Respond to security alerts and incidents raised through Huntress and Microsoft Defender, including containment, investigation and remediation. Implement and maintain security baselines: Conditional Access, MFA, Intune compliance, patching, backup and least-privilege access under GDAP. Continuous improvement Identify repeat issues and automate them away using PowerShell, CIPP, NinjaRMM scripting and HaloPSA workflows. Write and maintain technical documentation, runbooks and standard builds. Mentor L1 and L2 engineers through escalations, reviews and knowledge sharing. Contribute technical input to proposals, scoping and pre-sales conversations when required. On-call Participate in the after-hours on-call roster and respond to critical incidents outside business hours.

Requirements

What you must have: Experience: A minimum of 5 years in IT support or infrastructure engineering, including meaningful time at L3 or senior engineer level, ideally in an MSP or multi-client environment. Microsoft 365 and Entra ID: tenant administration, Exchange Online, SharePoint and Teams, Conditional Access, MFA, identity sync and hybrid identity. Intune and endpoint management: device enrolment, Autopilot, compliance and configuration policies, application deployment. Windows Server and infrastructure: Active Directory, Group Policy, DNS, DHCP, file services, and virtualisation (Hyper-V and/or VMware). Azure: deployment and support of IaaS workloads, virtual networking, VPN gateways and Azure-hosted services. Networking: hands-on configuration of firewalls, switching, VLANs, routing, site-to-site and remote access VPN. Fortinet FortiGate experience strongly preferred. Security operations: responding to and remediating real security incidents using EDR/MDR tooling. Backup and recovery: you have performed real restores, not just checked that the backup job went green. Scripting: working PowerShell you have written and used to solve problems in production. Change discipline: you plan, document and communicate changes, and you know when not to make one on a Friday afternoon. Customer skills and personality: a great personality and a genuine ability to relate to customers. You are comfortable on site, in front of business owners and end users, and people are glad to see you walk in. Communication: you can explain a technical problem clearly to a client's CFO and to a junior engineer, and write documentation other people can actually follow. Licence: full New Zealand driver licence and the right to work in New Zealand. Nice to have Microsoft certifications such as MD-102, MS-102, AZ-104 or SC-300. Fortinet NSE certifications. Experience with HaloPSA, NinjaRMM, CIPP, Huntress or similar MSP tooling. Experience working with GDAP and multi-tenant administration. Automation experience with Azure Functions, Logic Apps, Power Automate or APIs.

Start date

ASAP

PB Tech is an equal opportunity employer. It is our policy that all applicants be considered solely on the basis of qualifications and ability, without regard to race, religion, colour, sex, age, national origin or disability. We thank all applicants for their interest in the positions available, however only the successful applicant will be contacted.