Network and Infrastructure Engineer

Key accountabilities

Network Monitoring & Management

• Monitor network health, uptime, and performance across Azure and on-premises environments using Datto RMM and Azure Monitor

• Manage and document Virtual Networks (VNets), Network Security Groups (NSGs), subnets, and peering configurations

• Administer DNS management — internal zones, external registrar/DNS, MX, SPF, DKIM, and DMARC records

• Manage VPN gateway configurations (if applicable) and Azure Virtual Desktop (AVD) networking

Cloud Services Management (Azure)

• Manage Azure subscriptions, resource groups, RBAC, and policy assignments
• Administer Azure Virtual Machines — provisioning, OS patching, snapshots, and lifecycle management
• Manage Azure AD Connect sync rules, password hash sync, and troubleshooting

Endpoint Security

• Manage CrowdStrike Falcon console — sensor deployment, prevention policies, detection triage, and exclusion management
• Administer ThreatLocker — maintain approved application allowlist, ringfencing rules, and storage control policies
• Manage DefenceX ransomware protection and data exfiltration prevention policies
• Administer Microsoft Defender for Endpoint — onboarding, alert management, and integration with CrowdStrike
• Manage BitLocker encryption policies and ensure recovery key escrow to Entra ID for all devices

Patch Management

• Own the end-to-end patch management lifecycle across endpoints, servers, and Azure VMs
• Deploy security patches and updates using Microsoft Intune, DattoRMM, and Azure Update Manager
• Develop and maintain patch rollback procedures and test environments

Data Backup & Recovery

• Manage Azure Backup vaults — configure and monitor backup policies, retention settings, and geo-redundancy
• Conduct regular restore testing and validate backup integrity before go-live and on an ongoing basis
• Maintain and update the Disaster Recovery (DR) runbook and RTO/RPO documentation

Firewall Management

• Manage Azure Firewall and NSG rule creation, modification, and lifecycle review
• Conduct regular firewall rule-base audits and clean up redundant or overly permissive rules

MSP Transition & Knowledge Transfer

• Lead the structured knowledge transfer programme from our incumbent MSP (10 sessions) covering Azure, networking, endpoint security, backup, and licensing
• Obtain and validate all administrative access across Microsoft Entra ID, Azure Portal, ThreatLocker, Huntress, DefenceX, and DNS

Requirements:

• 6+ years of hands-on experience in network and infrastructure engineering, including cloud environments
• Deep expertise in Microsoft Azure — networking, VMs, Azure AD Connect, Cost Management, Azure Backup, and Azure Monitor
• Strong experience with Microsoft Intune / Endpoint Manager — device enrolment, Autopilot, compliance policies, Win32 app packaging
• Hands-on experience with endpoint security platforms — CrowdStrike Falcon, Threat Locker, or equivalent EDR/allow listing tools
• Proven network engineering skills — TCP/IP, DNS, DHCP, VPN, NSGs, routing and switching fundamentals
• Proficiency in PowerShell scripting for automation, reporting, and infrastructure management
• Strong experience with patch management and vulnerability remediation at scale
• Experience managing backup and disaster recovery solutions (Azure Backup, Veeam, or equivalent)
• Familiarity with Microsoft 365 administration — Exchange Online, SharePoint, Teams, Entra ID, Conditional Access
• Excellent written and verbal English communication skills — able to produce clear documentation and runbooks

Preferably:

• Microsoft Certified: Azure Administrator Associate (AZ-104) or Azure Solutions Architect (AZ-305)
• Experience with CrowdStrike Falcon, Huntress MDR, ThreatLocker, or DefenceX specifically
• CompTIA Security+ or equivalent security certification
• Experience with DattoRMM or similar Remote Monitoring & Management (RMM) platforms
• Familiarity with ITSM platforms such as Jira Service Management
• Experience working in financial services, wealth management, or other regulated environments
• Exposure to SIEM platforms such as Microsoft Sentinel or Splunk
• Experience with MSP transition or IT insourcing projects