MSP Systems Engineer

MSP Systems EngineerMechanicus LLC is a managed service provider with a security-forward practice — Microsoft Sentinel, Blackpoint MDR, and a real SOC workflow rather than a "we forward alerts to a third party" arrangement. Roughly a quarter of our monthly ticket volume is security work: targeted phishing investigations, malicious login attempts, SIEM triage, and MDR collaboration. We need a senior engineer who can own that work end-to-end.We're looking for an MSP Systems Engineer who will serve as the senior technical escalation point for complex infrastructure, cloud, and security issues across client environments.

You'll be the person Tier 2 calls when the impossible-travel alert turns out to be real, when the AVD environment needs re-architecting, when a client's M365 tenant has been compromised at 2am. You'll also drive the proactive work — hardening, detection engineering, post-incident reviews — that keeps the volume from getting worse.We don't expect you to be in the office. We do expect you to be reachable during a P1.What You'll Be DoingSecurity Operations & Incident ResponseInvestigate phishing attacks, suspicious login activity, and account compromise incidentsPerform threat hunting, log analysis, containment, and remediationLead response efforts for Microsoft 365 and Azure-related security eventsCollaborate with security partners and vendors during active incidentsConduct post-incident reviews and improve prevention strategiesMicrosoft 365 & Identity SecurityDesign and improve Conditional Access policies and identity security controlsManage and optimize Microsoft Defender and Entra ID security featuresImplement security baselines and hardening standards across client environmentsImprove MFA, privileged access, and identity governance workflowsCloud & Infrastructure EngineeringSupport and troubleshoot Azure infrastructure and Azure Virtual Desktop environmentsHandle complex escalations involving networking, virtualization, storage, and authenticationLead migrations involving Microsoft 365, Azure, servers, and cloud infrastructureAssist with automation and infrastructure-as-code initiativesTechnical LeadershipServe as the Tier 3 escalation point for advanced technical issuesMentor junior engineers and contribute to technical standardsCreate documentation, operational runbooks, and repeatable processesIdentify recurring problems and build long-term solutionsWhat We're Looking For5+ years of progressive IT experience, with at least 2 years focused on security operations (SOC analyst, security engineer, or senior engineer at a security-focused MSP).Strong Microsoft 365 security stack experience: Defender for Office 365, Defender for Endpoint, Defender for Identity, Entra ID Protection, Conditional Access at scale.Solid Azure fundamentals — Entra ID, AVD, networking (VNets, NSGs, Private Endpoints), RBAC, and at least familiarity with IaC (Bicep or Terraform).Incident response experience — you've worked a real BEC, a real ransomware incident, or a real account takeover end-to-end and can talk through the timeline, the decisions, and what you'd do differently.PowerShell at a functional scripting level — able to automate administrative tasks, work with Microsoft 365/Azure modules, and troubleshoot or modify existing scripts.Excellent written communication — incident reports, RCA documents, client-facing summaries that don't make a non-technical CFO panic.Nice To HaveCertifications: SC-200, SC-300, AZ-500 (mapped directly to our Microsoft Sentinel / Entra ID / Azure security work)Operational experience with Blackpoint Cyber MDR — incident handoff, isolation decisions, post-incident workflow with their SOC.Hands-on with our full operational stack: HaloPSA (PSA/ticketing), NinjaOne / NinjaRMM (RMM), CIPP (M365 multi-tenant admin), Hudu (documentation)Barracuda Email Protection policy management and incident response (BEC, mass-quarantine events).Experience designing CIS or NIST CSF-aligned baselines for SMB clients running Microsoft 365 and Azure.HR Information:Full-time, permanent roleRemote role - candidate must be based in the East Coast or Central USSalary: $80,000 – $110,000 depending on experience and certificationsAnnual performance bonus tied to security KPIs (mean time to detect, mean time to contain, recurring-incident reduction)Health insuranceSimple IRA12 days PTO to start (accrual increases with tenure) + 8 paid holidaysSchedule: Mondays-Fridays, 8 AM – 5PMHome office stipend