Network and Infrastructure Engineer

Key accountabilities

Network Monitoring & Management

• Monitor network health, uptime, and performance across Azure and on-premises environments using Datto RMM and Azure Monitor

• Manage and document Virtual Networks (VNets), Network Security Groups (NSGs), subnets, and peering configurations

• Administer DNS management — internal zones, external registrar/DNS, MX, SPF, DKIM, and DMARC records

• Manage VPN gateway configurations (if applicable) and Azure Virtual Desktop (AVD) networking

Cloud Services Management (Azure)

• Manage Azure subscriptions, resource groups, RBAC, and policy assignments

• Administer Azure Virtual Machines — provisioning, OS patching, snapshots, and lifecycle management

• Manage Azure AD Connect sync rules, password hash sync, and troubleshooting

Endpoint Security

• Manage CrowdStrike Falcon console — sensor deployment, prevention policies, detection triage, and exclusion management

• Administer ThreatLocker — maintain approved application allowlist, ringfencing rules, and storage control policies

• Manage DefenceX ransomware protection and data exfiltration prevention policies

• Administer Microsoft Defender for Endpoint — onboarding, alert management, and integration with CrowdStrike

• Manage BitLocker encryption policies and ensure recovery key escrow to Entra ID for all devices

Patch Management

• Own the end-to-end patch management lifecycle across endpoints, servers, and Azure VMs

• Deploy security patches and updates using Microsoft Intune, DattoRMM, and Azure Update Manager

• Develop and maintain patch rollback procedures and test environments

Data Backup & Recovery

• Manage Azure Backup vaults — configure and monitor backup policies, retention settings, and geo-redundancy

• Conduct regular restore testing and validate backup integrity before go-live and on an ongoing basis

• Maintain and update the Disaster Recovery (DR) runbook and RTO/RPO documentation

Firewall Management

• Manage Azure Firewall and NSG rule creation, modification, and lifecycle review

• Conduct regular firewall rule-base audits and clean up redundant or overly permissive rules

MSP Transition & Knowledge Transfer

• Lead the structured knowledge transfer programme from our incumbent MSP (10 sessions) covering Azure, networking, endpoint security, backup, and licensing

• Obtain and validate all administrative access across Microsoft Entra ID, Azure Portal, ThreatLocker, Huntress, DefenceX, and DNS

Requirements:

• 6+ years of hands-on experience in network and infrastructure engineering, including cloud environments

• Deep expertise in Microsoft Azure — networking, VMs, Azure AD Connect, Cost Management, Azure Backup, and Azure Monitor

• Strong experience with Microsoft Intune / Endpoint Manager — device enrolment, Autopilot, compliance policies, Win32 app packaging

• Hands-on experience with endpoint security platforms — CrowdStrike Falcon, Threat Locker, or equivalent EDR/allow listing tools

• Proven network engineering skills — TCP/IP, DNS, DHCP, VPN, NSGs, routing and switching fundamentals

• Proficiency in PowerShell scripting for automation, reporting, and infrastructure management

• Strong experience with patch management and vulnerability remediation at scale

• Experience managing backup and disaster recovery solutions (Azure Backup, Veeam, or equivalent)

• Familiarity with Microsoft 365 administration — Exchange Online, SharePoint, Teams, Entra ID, Conditional Access

• Excellent written and verbal English communication skills — able to produce clear documentation and runbooks

Preferably:

• Microsoft Certified: Azure Administrator Associate (AZ-104) or Azure Solutions Architect (AZ-305)

• Experience with CrowdStrike Falcon, Huntress MDR, ThreatLocker, or DefenceX specifically

• CompTIA Security+ or equivalent security certification

• Experience with DattoRMM or similar Remote Monitoring & Management (RMM) platforms

• Familiarity with ITSM platforms such as Jira Service Management

• Experience working in financial services, wealth management, or other regulated environments

• Exposure to SIEM platforms such as Microsoft Sentinel or Splunk

• Experience with MSP transition or IT insourcing projects