Senior Solutions Engineer (Professional Services)

Before you read further

This role requires five or more years inside a multi-client managed services provider. Not corporate IT, not a single in-house environment, not a systems integrator doing one project at a time. MSP. You have carried eight or more client environments at once, switched context between them in a single day, and worked inside a PSA and RMM every day. Applications without MSP background will not be shortlisted.

About the role

You are the senior technical seat on project delivery and the final escalation point for the service desk. You own infrastructure, cloud and network deployments end to end, on premise and in Azure, from discovery through cutover and handover.

You lead the design and direct other engineers through the build. You estimate your own work, hold to the estimate, and finish. Projects that run open ended are treated as a failure here, not as normal.

You will be handed undocumented environments and real deadlines and expected to return a design, a risk list and a sequenced plan without supervision.

What you will do

• Own infrastructure, cloud and network projects end to end across multiple clients
• Act as the top escalation point for L1 and L2 engineers and take ownership of what they cannot close
• Walk into undocumented environments, produce a defensible risk picture, and say plainly what is wrong
• Direct onsite technicians remotely with clear, safe, written instructions
• Produce technical scoping detail clean enough for someone else to write commercial scope from
• Mentor engineers and deliberately spread knowledge so no single person becomes a bottleneck

MSP experience we expect you to have

• Multiple client environments held at once, each with different stacks, standards and tolerances
• Production cutovers you personally led, not supported
• Working inside a PSA every day: service boards, project boards, configurations, agreements, and time entered against the right work type
• Documentation as a delivery obligation, written in the shared platform during the build, not after
• Inheriting environments nobody documented and making them safe
• Client facing on findings, including telling a client something is broken and was broken before you arrived
• Working to contracted hours and scope, and knowing when something is a change order rather than a favour

Tech stack

You must have production experience with most of the following. Tell us honestly which ones you do not.

Server and virtualization
Windows Server 2012 R2 through 2025, Active Directory, DNS, DHCP, Group Policy, Hyper-V, Failover Clustering, SQL Server 2016 and above including Express

Cloud and workplace
Microsoft Azure (VNET, NSG, Storage, Azure Files, VPN Gateway, Azure Backup, Resource Locks), Azure Virtual Desktop, FSLogix, Entra ID, Conditional Access, Microsoft 365, SharePoint Online, OneDrive, Exchange Online, Intune

Network and firewall
Fortinet FortiGate, FortiAnalyzer, FortiSwitch, FortiLink, FortiOS, IPsec site to site VPN, plus at least one of WatchGuard, SonicWall or Cisco for migration work

Backup and continuity
Datto BCDR or SIRIS, Datto SaaS Protection, Windows Server Backup, Veeam

MSP platforms
ConnectWise PSA, Datto RMM or NinjaOne, IT Glue or Hudu, ScreenConnect or Splashtop

Security tooling
Microsoft Defender, and working familiarity with EDR and email security consoles such as SentinelOne, Huntress, Bitdefender GravityZone, IronScales or Duo

Scripting
PowerShell

An advantage, not required
VMware vSphere, Ubiquiti UniFi, Aruba or HP switching, Azure Arc, Terraform or Bicep, Linux server administration

Delivery discipline

This carries the same weight as the technical requirements.

• You estimate before you start and flag overrun before it happens, not after
• Every project you own has a committed completion date and you defend it or renegotiate it in writing
• You push work down. Anything that does not need a senior engineer goes to an L1 or L2 the same day, with instructions
• You answer commercial questions with evidence. When a client asks whether a product is delivering value, you produce log sources, retention, alerts fired and reports consumed, not reassurance
• Your time lands on the right project and the right work type. Status in the PSA matches reality
• You genuinely delegate. The design stays with you, the build goes to another engineer, and the documentation is written during the build so the team can repeat it

Technical requirements

Certifications
AZ-104 or above, and Fortinet NSE4. Equivalent demonstrable depth will be considered but you will be tested on it. Security+ or SC-300 an advantage.

Networking and firewalls
Firewall migration and deployment as a core skill. You have replaced production firewalls including vendor to vendor migrations where the configuration is rebuilt and translated rather than restored. FortiGate deployment, HA pairs, end of hardware support cutovers. FortiAnalyzer, including proving it is delivering value. FortiSwitch under FortiLink. IPsec site to site tunnels including undocumented legacy tunnels you have to validate or retire. Comfortable when the outgoing firewall is also doing something else, such as acting as the wireless controller.

Windows Server and Active Directory
Domain controller builds and FSMO role migration off legacy servers. DNS, DHCP, sites and services. Experience rehabilitating servers that have gone years without patching or reboot.

SQL Server
Express versus Standard and the licensing consequences. Side by side installs for staged data migration. Backup job configuration and restore validation. Line of business database migrations with vendor validation.

Virtualization
Hyper-V host management, VM placement under constrained resources, failover clustering with shared storage. Physical to virtual recovery.

Microsoft Azure
Landing zone build from scratch. Azure Files. Site to site VPN from Azure to on premise appliances. Point to site client VPN and its DNS behaviour. Backup policies and resource locks. Domain controller in Azure.

Azure Virtual Desktop
Current hands on deployment experience within the last 12 months. Host pool design and sizing, session host image build and update lifecycle, FSLogix profile containers and storage back end, application groups and workspace assignment, scaling plans and cost control, Entra ID or hybrid join, and troubleshooting session and profile failures in production.

Microsoft 365
Large scale file share to SharePoint Online migration including site architecture, permissions, throughput strategy and cutover tracking. OneDrive known folder move. Entra ID hybrid identity alongside on premise AD.

Cybersecurity
Security is part of every build, not a separate team's problem. Secure by default deployment: no flat networks, no open management planes, no shared admin credentials. Conditional access, MFA enrolment and enforcement, privileged account separation, and the ability to spot a broken posture such as bypass accounts with no enrolled device. EDR and AV coverage reconciliation across consoles, including finding endpoints with no agent and mailboxes outside protection. Firewall security policy, segmentation, logging and retention. Vulnerability and lifecycle exposure: out of support operating systems still in production, unpatched servers, and the remediation plan that retires them. Backup as a security control, including restore validation and immutability. Able to map an environment against CIS, NIST CSF or ISO 27001 at control level and produce a gap register a client can act on. Incident support: contain, preserve evidence, write a clean factual account, escalate to the SOC rather than freelancing an investigation.

Backup and BCDR
Backup validation as distinct from backup configuration. You must be the person who insists on a proven restore before any migration proceeds.

Non technical
Strong written and spoken English. Composure to deliver bad findings directly to a client. Willingness to front load worst case scenarios rather than soften them. Genuine interest in mentoring.

What we offer

• ₱120,000 to ₱150,000 per month depending on depth
• Senior ownership of real North American client projects, not ticket queue work
• A team where design authority sits with the engineer doing the work
• Certification support and time to keep it current