Systems Engineer

Our Systems Engineering team owns the infrastructure that keeps a ~2,500-person global firm running around the clock: cloud (primarily AWS), Microsoft 365, Windows Server, identity platforms (Entra ID, Active Directory, SailPoint), and enterprise email flow. We are in the middle of a deliberate shift from click-ops to modern engineering practice: infrastructure as code, version control, CI/CD, cloud infrastructure, least-privilege identity, and AI-assisted workflows. We're hiring a System Engineer to help drive that shift. You'll operate and harden the current stack while actively replacing manual, one-off work with automation and repeatable, reviewable process. We're looking for a DevOps/SRE mindset: someone who sees a manual runbook and wants to turn it into code, contributes to technical standards, and uses AI to move faster than the team could before. Just as important, we want someone who questions why things are the way they are. Much of our stack was inherited; some of it is legacy or dependent on one person's knowledge. You should be comfortable looking at an established design, asking whether there's a better way, and making the case for change, grounded in a clear-eyed read of the pros, cons, and migration trade-offs, not change for its own sake. This is a broad remit: identity and access, email flow, cloud, and core infrastructure. We're not expecting you to arrive an expert in every one. We are looking for someone comfortable stepping into each area, learning fast, and growing into full ownership over time. What you'll do Automate and operate core infrastructure across AWS, Microsoft 365, and Windows Server, with reliability, security, and least privilege as defaults. Engineer identity and access across our identity platforms (Entra ID, Active Directory / Domain Controllers, and SailPoint), including provisioning, governance, and least-privilege models on-prem and in the cloud. Own and improve enterprise email flow: Exchange Online, our secure email gateway, and email authentication (SPF, DKIM, DMARC) across first- and third-party sending platforms. Evaluate inherited architecture and legacy tooling, ask why it works the way it does, and propose better approaches, backed by honest pros, cons, and migration trade-offs. Contribute to the move to infrastructure as code: build and maintain declarative infrastructure (our stack is OpenTofu and Spacelift) so environments are version-controlled, peer-reviewed, and reproducible. Put your infrastructure and automation under version control (Git), and work in a pull-request review and CI/CD workflow. Support and extend our cloud footprint across AWS and Azure, including networking, identity, and workload migration. Participate in operational coverage and incident response for a 24/7 business spanning the world, then help write the postmortems and automate the fix so it doesn't recur. Use AI to troubleshoot, script, document, and design faster, and share what works with the team. Help raise the bar on security, reliability, documentation, and repeatability through code review and collaboration. What we're looking for 3–5 years in systems / infrastructure / platform / SRE engineering. A DevOps/SRE mindset: you reach for automation and repeatable process over manual, one-off work, and can point to click-ops you've replaced (or want to replace) with code. You ask "why do we do it this way?" and push for something better, but you're honest about the trade-offs and know when a change is worth the effort and when it isn't. Solid scripting and automation skills (PowerShell and Bash required; Python, Javascript or similar a plus). Exposure to infrastructure as code (Terraform, Ansible, OpenTofu, etc.), and comfort (or eagerness to grow) working in Git with pull-request-based review. Strong working knowledge of the Microsoft ecosystem: Microsoft 365 and Windows Server. Comfort with identity platforms and identity security: Entra ID and Active Directory required; SailPoint or another…