Senior Systems Engineer

We’re hiring a Senior Systems Engineer as WRA builds its new internal IT & Cybersecurity functions. We are actively transitioning from an MSP model to a fully in-house model, and this role will operate under the guidance of our Director of Information Technology & Cybersecurity. This is also an excellent role for someone looking to refine their cybersecurity skillset.

In this role, you will act as the primary engineer for our cloud and SaaS platforms, including Microsoft 365, Azure infrastructure, Entra ID, endpoint management, and a variety of general platforms used by each of our departments. Initially, most of your time will focus on standing up new tools and assisting in the migration of select tools used by our MSP. Afterwards, your general duties will shift to engineering Azure Virtual Desktop, Microsoft 365/Entra ID, endpoint management and building automations.

You will be highly autonomous and will work closely with your Director to maintain and improve our current technology stack. Our 100-person workforce is highly distributed, and your priority is engineering our tools to enable our staff to do their best work securely, efficiently and consistently.

WRA has offices in the San Francisco Bay Area (San Rafael, Petaluma, and Emeryville) and in San Diego. This position may be performed fully remotely by candidates located in California, Colorado, Arizona, or Oregon but travel to our offices may be necessary 1 – 2 times per year on average.

Candidates in the Denver metro area are especially encouraged to apply.

\n In this role, you will be responsible for:

Cloud Infrastructure

• Own our Azure environment, including Azure Virtual Desktop and virtual servers, which enables our CAD, GIS and Accounting teams. This includes image management, patching, right-sizing, scaling and scheduling, backups, performance optimization, and software versioning.

• Deploy actionable virtual machine monitoring to measure performance (CPU, GPU, memory, disk and session latency), idle capacity and active use time, and implement alerts to monitor these metrics.

• Perform root-cause analysis of virtual infrastructure concerns and propose solutions.

• Administer our Microsoft 365 environment, including Exchange, SharePoint & OneDrive, Teams and data governance.

• Engage with your Director and our specialized departments to ensure their tools are appropriately sized, configured and performant.

• Co-manage our SaaS and cloud infrastructure backup platforms, including for Microsoft 365, Azure virtual machines and other platforms.

Identity & Access Management (IAM)

• Administer Entra ID and SSO, including conditional access, authentication, dynamic groups, and guest access governance.

• Own employee identity lifecycle automations for onboarding, offboarding and role changes.

• Maintain SCIM provisioning across our SaaS applications.

Endpoint & Mobile Device Management

• Manage our Windows and limited Mac fleet by administering our endpoint management platform, including device enrollment, Autopilot, compliance & configuration policies, app deployments and system patching.

• Manage our mobile device configuration and application policies.

AI & Automations

• Automate IT processes using PowerShell, Microsoft Graph and other platforms to reduce or eliminate manual administrative tasks and to ensure consistent quality.

• Collaborate with your Director and other stakeholders to improve our implementation of Claude AI, including Connector configurations, Skills and Design.

Cybersecurity

• Partner with your Director to build new security operations capabilities from product selection and concept trials through implementation and administration.

• Alongside your Director, administer our security stack, including our managed detection and response platform, email security, DNS and web filtering, and vulnerability management.

• Participate in our incident response process, including investigations and root-cause analyses, and apply technical containment measures as directed or delegated.

• Assist in strengthening our infrastructure to be compliant with industry-standard benchmarks such as CMMC and NIST SP 800-171.

General IT Support

• Work with our IT Operations Specialist as needed and serve as a final escalation point for complex IT Support requests.

• Participate in an on-call rotation for critical but rare IT outages and other emergent duties.

Change Management & Documentation

• Maintain runbooks, architecture diagrams, and system configuration documentation. Documentation must be considered a deliverable – not a “nice to have.”

• Follow industry-standard Change Management practices for all system changes.

To be successful in this role, you will need:

Experience & Location

• At least 6 years of direct experience supporting a hybrid or remote workforce of at least 50 employees as an engineer.

• Comfortable working fully remote with travel to our offices in California as described above.

• Able to demonstrate past history of performing duties in a high-trust role.

Technical Skills

• Strong history of managing mission-critical Azure Virtual Desktops and application-specific servers.

• Deep, hands-on experience with Microsoft 365 and Entra ID, including conditional access, provisioning, identity governance and general administration.

• Experience managing a distributed fleet of endpoints and mobile devices using Intune, NinjaOne, WorkspaceOne or comparable tools.

• Proven track record of utilizing PowerShell to administer Microsoft 365 and Azure.

How You Work

• A zero-trust security mindset demonstrated through the methods you provide IT service and engineer solutions.

• Excellent customer service skills and the ability to translate complex technical issues into plain language that anyone can understand.

Physical Requirements

• Able to perform physical duties that may include lifting up to 50 lbs, climbing ladders indoors, crawling under furniture and reaching behind wall-mounted equipment.

Bonus Points for experience with or having:

• Supporting CAD and GIS applications, such as AutoCAD, Civil 3D, ArcGIS and spatial datasets.

• Supporting Egnyte, Deltek VantagePoint, Elevia or markup tools like Bluebeam and Adobe Acrobat.

• Microsoft certifications, including (but not limited to) AZ-104, AZ-140, AZ-305, AZ-700, SC-200, SC-300, SC-401, MS-102 or MD-102.

• Familiarity with industry-standard frameworks, such as CMMC L1/L2, NIST SP 800-171, CCPA, SOC 2, ITSM, or ITIL.

• Executing platform migrations using third-party tools and/or PowerShell.

• Integrating IAM automations into ITSM platforms such as Jira, Freshservice, Zendesk or SolarWinds.

• Supporting the implementation of data retention policies.

• Administering UniFi Network and Protect.

\n

WRA has an established internal leveling system for our staff that maps to salary bands that have been informed by market data. Our leveling system is dependent on years of relevant industry experience, education, and the level of responsibility and autonomy at which you’re expected to operate.

We have posted a salary range that corresponds to the appropriate level for this position. In your first conversation with our recruiter, we will discuss leveling and compensation with you to make sure that our expectations are aligned.

*The salary range for this position is $130,000 – $145,000

Beyond salary, here’s how we take care of our people:

• Health coverage: Medical plans through Anthem and Kaiser Permanente (options vary by state). WRA pays 100% of employee-only premiums for our base medical plans and for Guardian dental and vision. You can buy up to another plan or add a spouse, domestic partner, ordependents at your own cost.

• Mind and body: Each year you get 5 free therapy sessions and 5 free life coaching sessions through Spring Health, plus a confidential, company-paid Employee Assistance Program.

• Retirement: You can join our 401(k) after 2 full months of service. It includes a company match of up to 2%, plus an annual 3% Safe Harbor contribution.

• Time to recharge: 10 to 20 vacation days a year that increase with tenure (some job levels start higher), up to 8.85 sick days a year, and 9 paid company holidays.

Who are we?

WRA’s an employee-owned environmental consultancy. We are a tenacious team of planners, engineers, and scientists, and we aim to leave the lands we love better than we found them.

Our clients and partners hire us because we’re skilled at navigating through challenging projects involving wildlands, parks, community spaces, and infrastructure. We bring over four decades of expertise, long-standing relationships, and connections to our local communities to make sure that projects are pursued in responsible ways where both people and the environment thrive.

As an organization, we believe that independence and interdependence are not mutually exclusive. We invest in systems, processes, and employee programs to support our staff’s collective engagement and success. At the same time, we encourage our employees to operate with an ownership mindset, taking responsibility for outcomes and being true to our commitments.

WRA’s company vision is to cultivate a sustainable future where people and the environment thrive, and that effort starts first with our staff. We are committed to building a diverse, equitable, and inclusive work environment, and we have developed flexible policies, internal practices, and are investing in programs that prioritize learning and sustainability. We aim to create conditions that allow employees to prioritize their families, lead healthy and balanced lives, and to bring their authentic selves to work every day. We believe that by creating an exceptional workplace, our employees will be able to do their best work and be able to meaningfully contribute to the sustainability of the environment and the communities in which we live.

WRA is an equal opportunity employer, and we are committed to creating a diverse environment. We recruit, employ, train, compensate and promote regardless of race, religion, color, national origin, gender, sexual orientation, disability, age, veteran status, and other protected status as required by applicable law.