Senior Network & Systems Engineer

You are the senior hands-on engineer for networks and servers across Evernets clients within the scope service levels and runbooks Evernet sets. When a network or server problem goes beyond our L1 and L2 engineers it comes to you and you see it through to the a Sev 1 you lead the technical response remotely or on site. You decide whether a non-standard change is safe you design networks and server set-ups at the scale of small and mid-size businesses and you deliver projects. You set the standards our engineers work to you watch for vendor security advisories before they become incidents and you teach the engineers around you. Our clients service levels range from business hours to 24x7. The role stops at people management scheduling and client communication which belong to the Service Delivery Manager and at pricing scope and spend which need approval.

• Take network and server escalations from the L1 and L2 engineers and the NOC through to the fix. When it reaches you it is yours
• Lead the technical response in a Sev 1 remotely or on site
• Open vendor TAC cases at any hour and own them until they close
• Find the root cause of repeat faults and see the preventive action through

• Review and approve non-standard changes on networks and servers before they run: a backup first a rollback plan and a check afterwards
• Stop a change that is not safe and say what would make it safe
• Design networks and server set-ups for small and mid-size businesses: multi-site firewalls VLAN plans VPN and SD-WAN server and virtualisation builds
• Review Microsoft 365 tenant-wide changes such as Conditional Access policies and mail flow when asked to

• Write and maintain Evernets baselines for firewall switch and server configuration and check that clients estates meet them
• Keep runbooks and IT Glue records current. Update a runbook within five business days of a new kind of fix
• Track security advisories from firewall and network vendors. Assess each critical one against our clients equipment and get exposed devices patched or mitigated under change control
• Keep the record of vendor support for critical client equipment current and raise gaps with the Service Delivery Manager

• Contain the incident technically following the security runbook: isolate hosts block traffic at the firewall disable accounts
• Work with the managed detection and response (MDR) security operations centre which investigates
• Give the Service Delivery Manager the technical facts for client communication

• Design and deliver small and mid-size infrastructure projects yourself: firewall and switch replacements new sites and office moves server and virtualisation migrations backup deployments and security hardening
• On larger projects own the technical design approve the changes and be present for key cutovers while L2 engineers deliver under your technical direction
• Scope and estimate the technical work on projects you will deliver
• Projects take about 30 to 40% of your time in weeks when you are not on call. Incidents come first

• Coach the L1 and L2 engineers on networks and servers: work faults with them review their changes and explain your reasoning
• Grow what the L2 engineers can close without you

• Firewalls: enterprise next-generation firewalls such as Palo Alto Networks and Fortinet FortiGate. Policies NAT site-to-site and remote-access VPN security profiles and HA pairs including failover that does not behave. Expert in at least one platform and willing to learn others
• Switching and routing: VLANs trunks spanning tree link aggregation stacked or redundant switches static routing and dynamic routing at a working level
• Servers: Windows Server Active Directory DNS DHCP and Group Policy; virtualisation on Hyper-V or VMware; backup and restore for example with Veeam
• Microsoft 365 at L2 level: Entra ID users groups and MFA; Exchange Online mail flow; Intune basics
• Security: hardening firewalls and servers (admin access MFA on remote access least-privilege rules) and patching against published vulnerabilities
• Troubleshooting: from evidence using logs counters and packet captures
• Change control: standard emergency and planned changes each with a backup taken first and a rollback ready

• Hands-on with more than one firewall platform
• SD-WAN and wireless design
• Failover clustering and SAN or NAS storage
• Microsoft 365 security: Conditional Access and Defender
• Endpoint detection and response and MDR services such as CrowdStrike or Huntress
• MSP tools such as HaloPSA NinjaOne LogicMonitor and IT Glue
• PowerShell or other scripting

• Clear spoken and written English because you explain faults to clients and the NOC by phone often at night and write the ticket notes designs and runbooks other engineers work from
• Calm and clear with client staff during an incident including on site at night

The behaviours below are pass or fail:

• You write it down. The fix the reasoning and the vendor case number go on the HaloPSA ticket and the runbook is updated. If only you know it it is not done.
• You back up before you change and follow change control. No quiet changes.
• You say no to an unsafe change whoever wants it tonight and say what would make it safe.
• You call early. Open the vendor case before the clock runs out. Staying stuck on a Sev 1 in silence is a fail.
• You teach rather than take over. Outside a Sev 1 an engineer who brings you a problem leaves knowing more.
• You answer when you are on call. Cannot cover a week Swap it before it starts.
• You keep to the access controls. Remote work on client systems goes only through the route each client requires. You never switch off MFA or open admin access to make a job easier.

Required: none. We judge your skills by what you have done and by a practical test at interview.

Preferred:

• Cisco CCNA or CCNP Enterprise
• Fortinet NSE 4 or higher. A Fortinet Certified Professional (FCP) from the FortiGate or FortiOS Administrator exam now shows as NSE 4
• Palo Alto Networks Network Security Professional Next-Generation Firewall Engineer or an active PCNSA or PCNSE
• A Microsoft associate certification such as Azure Administrator (AZ-104) Endpoint Administrator (MD-102) Identity and Access Administrator (SC-300) or Windows Server Administrator
• Veeam Certified Engineer (VMCE)
• ITIL 4 Foundation

• Hands-on infrastructure experience across networks and servers typically five years or more. We judge it by what you have done:
  • you have led the technical response to a Sev 1 or P1 and restored service
  • you have been the engineer your team turned to when others were stuck
  • you have delivered an infrastructure project such as a firewall or switch replacement or a server migration with a change and rollback plan
• Helps not required:
  • MSP experience looking after many client estates at once
  • work on 24x7 service levels
  • coaching engineers
• A degree is not required

• Location: based in Singapore because you go on site for faults that cannot be fixed remotely and for project work across Singapore.
• Working hours: weekdays 09:0018:00 SGT when clients the Service Delivery Manager and the engineers work.
• On call on a rota with the other engineers including nights weekends and public holidays because clients on 24x7 service levels need a fast restore:
  • technical on call: you answer the NOC within 15 minutes and work the fault remotely
  • onsite responder: you reach the site within 60 minutes at night when the fault needs hands
  • senior on call: second line behind the technical on call for Sev 1s on clients with 24x7 service levels answering within 30 minutes
  • How a night call-out is recovered the next day: to be confirmed.
• Site work: at client sites across Singapore. A driving licence is not required.
• Access: you reach client systems remotely only through Evernets Singapore jump host or VDI plus any further controls a client requires.
• Screening: some clients require security screening and a confidentiality undertaking before you work on their sites or systems. You must be able to pass it where a client requires it.
• Right to work: you need the right to work in Singapore or must be eligible for a work pass.

• A quarterly performance bonus tied to the roles measures and to the projects you deliver
• An on-call allowance and call-out pay
• A full-time permanent role

Apply through the link in this advert. Your application is held in our recruiting system and handled in line with Singapores Personal Data Protection Act. If your experience matches we will invite you to a short first-round call.