> Markdown version of [/jobs/ext/4639525-it-infrastructure-engineer-operations-concord-ca](https://www.wearedevelopers.com/jobs/ext/4639525-it-infrastructure-engineer-operations-concord-ca). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # IT Infrastructure Engineer (Operations) - Concord, CA - **Company:** HIERRO, LLC - **Location:** Concord, CA, United States - **Experience:** Experienced - **Salary:** $95,000 - $125,000 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Active Directory, JIRA, Microsoft Azure, Microsoft Online Services, Business Software, Cluster Analysis, Information Systems, Dynamic Host Configuration Protocol, Domain Name System (DNS), Failover Clustering, Hyper-V, Network Security, Microsoft SQL Server, Windows Servers, Routing, Citrix Systems, Public Key Infrastructure, Query Optimization, Runbook, Management of Software Versions, Virtual Local Area Networks, Virtualization Technology, VMware VSphere, Firewalls (Computer Science), Microsoft InTune, Storage Technologies, Information Technology, Veeam, Servicenow, Vmware - **Published:** November 8, 2026 - **Apply:** https://www.careerbuilder.com/job-details/it-infrastructure-engineer-operations-concord-ca-concord-ca--b9fcef10-cc15-44ce-9123-ba9e1434f4b6 ## About the Role Information Technology & Information Systems, Customer Support/Service, Willing to Travel, Professional Services, U.S. National Institute of Standards and Technology (NIST), Government, Embedded Systems, Legal, Distribution Services, Microsoft Windows System Administration, * US-based work location and US-person status (matrix #11). You must be based in the United States and qualify as a US person: US citizen, US national, lawful permanent resident (green card holder), or protected individual (refugee or asylee) under US law. Authorization to work in the United States is not sufficient on its own. A non-immigrant work visa (H-1B, L-1, TN, and similar), F-1 OPT/CPT, or an Employment Authorization Document does not meet this requirement. This role's access to Controlled Unclassified Information and export-controlled systems is restricted to US persons under CMMC L2 and US export control regulations (ITAR / EAR). * Ability to work onsite at a client facility in the posted location (see Work Environment). * 4 to 6 years operating production infrastructure in a multi-client service delivery environment (matrix #10). * Hands-on Windows Server operational depth (matrix #1). * Production virtualization operations on Hyper-V or VMware vSphere (matrix #2). * Veeam Backup and Replication operations, including restores (matrix #4). * Microsoft 365 and Azure tenant administration at a production level (matrix #5). * Escalation ownership with a stated stop-and-escalate boundary (matrix #13). * Audit-ready ticketing and documentation discipline (matrix #9, #16). ## Description MSP4 operates as the embedded IT department for a portfolio of clients spanning professional services, legal, distribution, manufacturing, and government sectors. Environments range from 50 to 1,500 users, with CMMC L2, NIST 800-171, and SOC 2 as active requirements. This role keeps running environments running. You own the server and platform layer in steady state: the escalations that pass above the endpoint and site tier, the patching and monitoring and health work that stops incidents from happening, and the day-to-day administration of Windows Server, virtualization, storage, backup, and Microsoft cloud across your assigned clients. You are the technical ceiling of the support organization. L2 escalations land with you and stop there unless the answer is a design change - at which point they go to the Senior Infrastructure Engineer who owns that domain. Knowing which is which, and saying so rather than guessing, is most of the job., * Own L2 escalations at the server and platform layer: take what passes the endpoint and site tier, resolve it within scope, and escalate cleanly to the Senior Infrastructure Engineer when the fix is a design change rather than a repair * Administer Windows Server environments day to day: Active Directory, DNS, DHCP, Group Policy, PKI, certificate services, and file and print services * Operate Hyper-V and VMware vSphere clusters: VM lifecycle, capacity monitoring, host patching, live migration, HA behavior, and snapshot hygiene * Run storage and clustering operations: provisioning, volume changes, capacity monitoring, and health checks against failover clustering and Storage Spaces Direct or comparable SAN/HCI platforms. Storage architecture sits with Senior Infrastructure Engineering * Operate Veeam Backup and Replication: job management, backup verification, restore execution, repository and retention operations, and backup gap remediation * Administer Microsoft 365 and Azure tenants: identity, licensing, Intune policy application, and Conditional Access within established standards * Perform SQL Server platform work supporting client ERP and line-of-business applications: patching, version upgrades, backup coordination with Veeam, and baseline instance administration. DBA-level query tuning, indexing strategy, and application-side schema work sit with client DBAs or application vendors * Execute network change at defined scope: firewall rule adds and modifications against approved standards, VLAN configuration, and switch port and access layer work. Routing, firewall policy design, and segmentation architecture sit with Senior Network Security Engineering - the stop-and-escalate boundary is stated, not guessed * Apply STIG hardening and NIST 800-171 control execution at the server and platform layer in support of CMMC L2 and SOC 2, and capture the evidence * Run the proactive work: patching cadence, monitoring coverage, health checks, capacity review, and closing the gap between a well-designed environment and a well-run one * Receive completed projects into managed operations: review the handover, confirm the runbooks work, and own the platform from that point forward * Communicate with client technical contacts and non-technical stakeholders on infrastructure work, change windows, and incidents * Maintain ticketing and change discipline in a PSA or ITSM platform (Jira Service Management preferred; HaloPSA, ConnectWise, Autotask, or ServiceNow transferable), 1 Windows Server Technical Active Directory, DNS, DHCP, Group Policy, PKI, and certificate services at hands-on depth. 2 Virtualization Technical Production Hyper-V or VMware vSphere: host and cluster work, VM lifecycle, patching, live migration, and HA behavior. 3 Clustering and storage Technical Windows failover clustering and Storage Spaces Direct, or comparable SAN/HCI platform work, including capacity and layout decisions within a given design. 4 Backup and recovery Technical Veeam Backup and Replication: job configuration within standards, restore execution, recovery testing, and evidence capture. 5 Microsoft 365 and Azure Technical Tenant work, identity and licensing, Intune, and Conditional Access within established standards. 6 SQL Server platform work Technical Installation, patching, version upgrades, licensing awareness, and Veeam-coordinated backup. Platform layer, not DBA-level query tuning. 7 Compliance control execution Functional STIG application and NIST 800-171 control execution at the server and platform layer, with audit evidence captured as part of the work. 8 Multi-client service delivery Functional Context-switches across clients while holding to established standards. 9 Documentation discipline Consulting Runbooks, change records, as-built and configuration records, and operating procedures another engineer can work from without asking questions. 10 Production experience Credentials 4 to 6 years building and operating infrastructure in production. 11 US-person status Credentials US citizen, US national, lawful permanent resident, or protected individual (refugee or asylee) under US law. Required for CUI and export-controlled system access under CMMC L2. Authorization to work in the US is not sufficient: a non-immigrant work visa (H-1B, L-1, TN), F-1 OPT/CPT, or an Employment Authorization Document does not satisfy this requirement. 12 Relevant certifications Credentials Microsoft Azure Administrator Associate (AZ-104), Windows Server Hybrid Administrator Associate (AZ-800/AZ-801, or AZ-802), VMware VCP, or Veeam VMCE. A plus, not a requirement. Operations specialization 13 Escalation ownership Functional Takes tickets escalated from the endpoint and site tier, resolves within scope, and escalates architecturally novel work upward cleanly - with the boundary stated rather than guessed. 14 Operational reliability Functional Keeps assigned environments patched, monitored, backed up, and healthy. Finds problems through review rather than through incidents. 15 Network change at defined scope Technical Firewall rule changes against an approved standard, VLAN configuration, and switch port and access layer work, with a clear stop-and-escalate boundary to Senior Network Security Engineering. 16 Ticketing discipline Consulting Clean, audit-ready change records in a PSA or ITSM platform (Jira Service Management preferred; HaloPSA, ConnectWise, Autotask, or ServiceNow transferable). 17 Three-way communication Consulting Works with non-technical client stakeholders, with the L2 technicians below in the escalation path, and with Senior Engineering above, across same-day context switches., * Windows failover clustering and Storage Spaces Direct, or comparable SAN/HCI depth (matrix #3). * Defined-scope network change: firewall rule changes, VLAN, and switch port work (matrix #15). * SQL Server platform work supporting ERP or line-of-business applications (matrix #6). * STIG and NIST 800-171 control execution with evidence capture (matrix #7). * Citrix infrastructure operations. * Prior multi-client or MSP service delivery experience (matrix #8). * Certifications: AZ-104, AZ-800/AZ-801 or AZ-802, VMware VCP, or Veeam VMCE (matrix #12)., Knows the escalation boundary Resolves what belongs at this tier and escalates architecturally novel change upward cleanly, with the boundary stated rather than guessed. Operational reliability Keeps assigned environments running, patched, monitored, and recoverable. Closes the gap between a well-designed system and a well-run one. Executes within the framework Operates against what exists, flags what does not work, and proposes improvements within scope rather than redesigning on personal preference. Documentation discipline Leaves behind audit-ready change records and runbooks that let another engineer operate the environment unaided. Three-way communication Communicates clearly with non-technical client stakeholders, with L2 technicians below, and with Senior Engineering above, across same-day context switches between clients., 1. Are you currently based in the United States, and will you perform this role from within the United States? 2. Do you qualify as a US person as defined above - US citizen, US national, lawful permanent resident, or protected individual? Then answer the following in order: 3. Describe the most complex escalation you have taken from a front-line tier in the last 12 months. What came up to you, what did you actually change, and what did you send back down so it would not come up again? 4. Describe a ticket you escalated upward even though it would have been faster to handle it yourself. What was the boundary that made you escalate, and how did that decision play out? Close with the following statement exactly: "I understand that my scope is server and platform operations within the design owned by the Senior Infrastructure Engineer and the framework owned by the Principal Solutions Architect."