IT Infrastructure Engineer (Operations) - Concord, CA

MSP4 operates as the embedded IT department for a portfolio of clients spanning professional services, legal, distribution, manufacturing, and government sectors. Environments range from 50 to 1,500 users, with CMMC L2, NIST 800-171, and SOC 2 as active requirements.

This role keeps running environments running. You own the server and platform layer in steady state: the escalations that pass above the endpoint and site tier, the patching and monitoring and health work that stops incidents from happening, and the day-to-day administration of Windows Server, virtualization, storage, backup, and Microsoft cloud across your assigned clients.

You are the technical ceiling of the support organization. L2 escalations land with you and stop there unless the answer is a design change - at which point they go to the Senior Infrastructure Engineer who owns that domain. Knowing which is which, and saying so rather than guessing, is most of the job., * Own L2 escalations at the server and platform layer: take what passes the endpoint and site tier, resolve it within scope, and escalate cleanly to the Senior Infrastructure Engineer when the fix is a design change rather than a repair

• Administer Windows Server environments day to day: Active Directory, DNS, DHCP, Group Policy, PKI, certificate services, and file and print services
• Operate Hyper-V and VMware vSphere clusters: VM lifecycle, capacity monitoring, host patching, live migration, HA behavior, and snapshot hygiene
• Run storage and clustering operations: provisioning, volume changes, capacity monitoring, and health checks against failover clustering and Storage Spaces Direct or comparable SAN/HCI platforms. Storage architecture sits with Senior Infrastructure Engineering
• Operate Veeam Backup and Replication: job management, backup verification, restore execution, repository and retention operations, and backup gap remediation
• Administer Microsoft 365 and Azure tenants: identity, licensing, Intune policy application, and Conditional Access within established standards
• Perform SQL Server platform work supporting client ERP and line-of-business applications: patching, version upgrades, backup coordination with Veeam, and baseline instance administration. DBA-level query tuning, indexing strategy, and application-side schema work sit with client DBAs or application vendors
• Execute network change at defined scope: firewall rule adds and modifications against approved standards, VLAN configuration, and switch port and access layer work. Routing, firewall policy design, and segmentation architecture sit with Senior Network Security Engineering - the stop-and-escalate boundary is stated, not guessed
• Apply STIG hardening and NIST 800-171 control execution at the server and platform layer in support of CMMC L2 and SOC 2, and capture the evidence
• Run the proactive work: patching cadence, monitoring coverage, health checks, capacity review, and closing the gap between a well-designed environment and a well-run one
• Receive completed projects into managed operations: review the handover, confirm the runbooks work, and own the platform from that point forward
• Communicate with client technical contacts and non-technical stakeholders on infrastructure work, change windows, and incidents

• Maintain ticketing and change discipline in a PSA or ITSM platform (Jira Service Management preferred; HaloPSA, ConnectWise, Autotask, or ServiceNow transferable), 1 Windows Server Technical Active Directory, DNS, DHCP, Group Policy, PKI, and certificate services at hands-on depth. 2 Virtualization Technical Production Hyper-V or VMware vSphere: host and cluster work, VM lifecycle, patching, live migration, and HA behavior. 3 Clustering and storage Technical Windows failover clustering and Storage Spaces Direct, or comparable SAN/HCI platform work, including capacity and layout decisions within a given design. 4 Backup and recovery Technical Veeam Backup and Replication: job configuration within standards, restore execution, recovery testing, and evidence capture. 5 Microsoft 365 and Azure Technical Tenant work, identity and licensing, Intune, and Conditional Access within established standards. 6 SQL Server platform work Technical Installation, patching, version upgrades, licensing awareness, and Veeam-coordinated backup. Platform layer, not DBA-level query tuning. 7 Compliance control execution Functional STIG application and NIST 800-171 control execution at the server and platform layer, with audit evidence captured as part of the work. 8 Multi-client service delivery Functional Context-switches across clients while holding to established standards. 9 Documentation discipline Consulting Runbooks, change records, as-built and configuration records, and operating procedures another engineer can work from without asking questions. 10 Production experience Credentials 4 to 6 years building and operating infrastructure in production. 11 US-person status Credentials US citizen, US national, lawful permanent resident, or protected individual (refugee or asylee) under US law. Required for CUI and export-controlled system access under CMMC L2. Authorization to work in the US is not sufficient: a non-immigrant work visa (H-1B, L-1, TN), F-1 OPT/CPT, or an Employment Authorization Document does not satisfy this requirement. 12 Relevant certifications Credentials Microsoft Azure Administrator Associate (AZ-104), Windows Server Hybrid Administrator Associate (AZ-800/AZ-801, or AZ-802), VMware VCP, or Veeam VMCE. A plus, not a requirement. Operations specialization 13 Escalation ownership Functional Takes tickets escalated from the endpoint and site tier, resolves within scope, and escalates architecturally novel work upward cleanly - with the boundary stated rather than guessed. 14 Operational reliability Functional Keeps assigned environments patched, monitored, backed up, and healthy. Finds problems through review rather than through incidents. 15 Network change at defined scope Technical Firewall rule changes against an approved standard, VLAN configuration, and switch port and access layer work, with a clear stop-and-escalate boundary to Senior Network Security Engineering. 16 Ticketing discipline Consulting Clean, audit-ready change records in a PSA or ITSM platform (Jira Service Management preferred; HaloPSA, ConnectWise, Autotask, or ServiceNow transferable). 17 Three-way communication Consulting Works with non-technical client stakeholders, with the L2 technicians below in the escalation path, and with Senior Engineering above, across same-day context switches., * Windows failover clustering and Storage Spaces Direct, or comparable SAN/HCI depth (matrix #3).

• Defined-scope network change: firewall rule changes, VLAN, and switch port work (matrix #15).
• SQL Server platform work supporting ERP or line-of-business applications (matrix #6).
• STIG and NIST 800-171 control execution with evidence capture (matrix #7).
• Citrix infrastructure operations.
• Prior multi-client or MSP service delivery experience (matrix #8).
• Certifications: AZ-104, AZ-800/AZ-801 or AZ-802, VMware VCP, or Veeam VMCE (matrix #12)., Knows the escalation boundary Resolves what belongs at this tier and escalates architecturally novel change upward cleanly, with the boundary stated rather than guessed. Operational reliability Keeps assigned environments running, patched, monitored, and recoverable. Closes the gap between a well-designed system and a well-run one. Executes within the framework Operates against what exists, flags what does not work, and proposes improvements within scope rather than redesigning on personal preference. Documentation discipline Leaves behind audit-ready change records and runbooks that let another engineer operate the environment unaided. Three-way communication Communicates clearly with non-technical client stakeholders, with L2 technicians below, and with Senior Engineering above, across same-day context switches between clients., 1. Are you currently based in the United States, and will you perform this role from within the United States?

1. Do you qualify as a US person as defined above - US citizen, US national, lawful permanent resident, or protected individual?

Then answer the following in order:

1. Describe the most complex escalation you have taken from a front-line tier in the last 12 months. What came up to you, what did you actually change, and what did you send back down so it would not come up again?
2. Describe a ticket you escalated upward even though it would have been faster to handle it yourself. What was the boundary that made you escalate, and how did that decision play out?

Close with the following statement exactly: “I understand that my scope is server and platform operations within the design owned by the Senior Infrastructure Engineer and the framework owned by the Principal Solutions Architect.”

Information Technology & Information Systems, Customer Support/Service, Willing to Travel, Professional Services, U.S. National Institute of Standards and Technology (NIST), Government, Embedded Systems, Legal, Distribution Services, Microsoft Windows System Administration, * US-based work location and US-person status (matrix #11). You must be based in the United States and qualify as a US person: US citizen, US national, lawful permanent resident (green card holder), or protected individual (refugee or asylee) under US law. Authorization to work in the United States is not sufficient on its own. A non-immigrant work visa (H-1B, L-1, TN, and similar), F-1 OPT/CPT, or an Employment Authorization Document does not meet this requirement. This role’s access to Controlled Unclassified Information and export-controlled systems is restricted to US persons under CMMC L2 and US export control regulations (ITAR / EAR).

• Ability to work onsite at a client facility in the posted location (see Work Environment).
• 4 to 6 years operating production infrastructure in a multi-client service delivery environment (matrix #10).
• Hands-on Windows Server operational depth (matrix #1).
• Production virtualization operations on Hyper-V or VMware vSphere (matrix #2).
• Veeam Backup and Replication operations, including restores (matrix #4).
• Microsoft 365 and Azure tenant administration at a production level (matrix #5).
• Escalation ownership with a stated stop-and-escalate boundary (matrix #13).
• Audit-ready ticketing and documentation discipline (matrix #9, #16).

• Full onsite at a client facility in your posted location, within the United States, with regional coverage for nearby MSP4 clients where it applies.
• Up to 10% regional travel.
• Planned off-hours work for maintenance windows and patching is a normal part of the role.
• US-based work location and US-person status required. Work authorization alone (work visa, OPT/CPT, or EAD) does not qualify; see Eligibility & Scoring for the full definition.
• Extended periods at a computer performing configuration, operations, and documentation work; regular hands-on work in client server rooms and data closets.

MSP4 does not operate like a traditional IT department or a ticket-centric help desk. We function as embedded IT leadership for our clients, accountable to their outcomes.

Our Principal Solutions Architect owns the design framework and the standards every environment runs on. Our senior engineers own design within their domain. Engineers at this tier operate within both, and grow into design ownership by demonstrating it on progressively larger scope. The tier structure keeps a multi-client portfolio consistent and audit-ready.

We investigate before we change, fix causes rather than symptoms, and measure success by stability, coverage, recoverability, and documentation rather than raw ticket counts. Incidents are expected to produce permanent remediation, improved monitoring, and corrected documentation - not heroics.

We are building the operating model in real time. Some processes are documented; others are being written as we go. People here help shape what does not yet exist while executing reliably within what does., MSP4, LLC provides infrastructure, security, and IT advisory services to mid-market professional services, manufacturing, distribution, legal, and government clients across the United States. Our commercial practice and regulated practice serve organizations with serious compliance requirements including SOC 2 Type II and CMMC Level 2.