System Administrator II

Systems Administrator IIQE Solar is one of the nation's largest independent solar and BESS operations and maintenance providers, with over 15 years of operating experience. We manage 10 GW of solar and 7.5 GWh of BESS across 44 states, supporting asset owners with multi-hundred MW utility solar projects and large standalone BESS systems. We're pure-play O&M. That focus means our entire organization is built around one thing: keeping solar and storage assets running well. Our technicians carry broad OEM certifications, and our in-house capabilities span MV/HV electrical, vegetation management, engineering, and capital improvements, to streamline asset management for project owners.You'll join QE Solar's Site Reliability Engineering (SRE) team, which runs the corporate technology our office and field employees use every day: laptops, tablets and iPads, identity and sign-in, Microsoft 365, endpoint security and IT asset inventory.The role:The Systems Administrator II is the escalation point behind our Service Desk:You go looking for problems and fix them before anyone reports them.You own platforms end to end.You resolve what Tier 1 cannot, and fix the cause, not only the ticket.You automate the manual work you find, in code others can run.You bring the team up with you: you teach what you know and help teammates get certified on the platforms they work on.Everything we run should live in a standard operating procedure (SOP). Team members certify on each SOP by running it with a teammate observing, so knowledge is shared and anyone can cover.Our environment:Endpoints: Windows laptops and tablets in Microsoft Intune with Autopilot; iPads in JAMF; patching through Intune update rings, manufacturer update tools and a remote monitoring and management (RMM) platformIdentity: Okta (single sign-on for Microsoft 365, Device Access, Lifecycle Management) and Microsoft Entra IDMicrosoft 365: Exchange Online, Defender for Office 365, SharePoint, TeamsSecurity: managed detection and response (MDR) with SIEM, privilege elevation, DNS filtering, and security awareness trainingService management: Jira Service Management with Assets as the inventory of record, Confluence for SOPs, PagerDuty for on-callNetwork: firewalls and switching, owned by network engineering, but you are willing to step in to support when needed.What you'll own:Finding problems first. Don't wait for tickets. Look through the systems you own for issues before they become tickets. Fix them, or bring a fix with its cost.Platform lead. Serve as lead for platforms we run. Own the design, configuration baselines, change records, SOPs and health metrics, and help teammates get certified on them. Support patch management across all of our environments, including restricted ones once authorized and trained.Design and build. Design and build Intune compliance and configuration baselines, Autopilot profiles, update rings and Conditional Access policies, plus Okta app integrations with SCIM provisioning and group rules.Incidents. Lead P1 and security incidents through containment, keep your lead informed, and write up the root cause and fix.Security alerts. Triage MDR, SIEM and phishing alerts. Contain threats to accounts and devices. Take your turn in the weekly after-hours on-call rotation.Automation. Write PowerShell and Microsoft Graph automation that runs in production on a schedule. Build it so others can run and maintain it, and document it so others understand it.Projects. Deliver projects end to end through change control, each with a plan, a change record and a tested rollback. Examples: platform migrations and onboarding acquired companies' users, devices and tenants. Work across the company with HR, finance, field operations, and our network, OT and product teams to plan the work, support their needs and land changes with the people they affect.Identity lifecycle. Automate joiner, mover and leaver changes across Okta and Entra, including license assignment by role and access reviews.Inventory. Keep our asset inventory accurate, and automate the reconciliation wherever you can.Escalations and coaching. Take Tier 2 tickets through to root cause. Turn repeat issues into SOP changes, and coach Service Desk staff and junior administrators to run them.Your first 90 days:Day 30, learn and baseline: certified on the core SOPs; working the Tier 2 queue; shadowing on-call; your lead platforms assigned, with a health baseline for each.Day 60, deliver: primary on-call; one design change delivered on one of your platforms through change control; one PowerShell or Microsoft Graph automation running in production; patch ownership mapped across Intune, manufacturer tools and the RMM, with one source of truth for patch compliance; at least one problem found and fixed that no one had reported.Day 90, own and lead: led a tabletop exercise as incident lead; the full SOP set for your platforms current, with at least one teammate certified on it; a six-month roadmap for your platforms approved by the IT Operations Manager.Required Experience:4+ years in IT systems or security operations, including 2+ years at Tier 2 or above, in an environment of several hundred users or moreA record of finding and fixing problems no one had reported, with specific examples and resultsA record of raising the people around you: teammates you trained or mentored into new skills and certifications, and knowledge you shared rather than keptDesigned and built Intune compliance and configuration baselines, Autopilot enrollment and Conditional Access in a production tenantBuilt identity-provider integrations (Okta preferred): SAML or OIDC apps, SCIM provisioning, group rules and lifecycle automationIncident lead on at least one security incident, from detection through containment and post-incident reviewPowerShell (or an equivalent scripting language) automation running in production, using Microsoft Graph and vendor APIs, that you built and maintain, with scheduling, logging and error handlingAt least one infrastructure project delivered end to end through change control, such as an MDM, EDR or tenant migrationSOPs you wrote that others run, and change records with tested rollback plansAvailable for the weekly after-hours on-call rotationLive within commuting distance of Scottsdale, AZ, or relocate before your start date. This role is on-site.Preferred Experience:Microsoft MD-102 or SC-300, or CompTIA CySA+. We value certifications as a signal, but we hire and certify on demonstrated skill.Okta Workflows or Lifecycle Management; JAMF; an RMM platformJira Service Management Assets or another CMDBSupport for a distributed field workforce on tablets and mobile devicesEducation:Bachelor's degree in an IT or security field, or equivalent experienceOther requirements:Authorized to work in the United StatesADA / Physical DemandsQE Solar is committed to providing equal employment opportunities and reasonable accommodations in accordance with the Americans with Disabilities Act (ADA) and applicable state and local laws. The physical and mental demands described below are representative of those required to successfully perform the essential functions of this position. Reasonable accommodations may be made to enable qualified individuals with disabilities to perform these essential functions.This is an in office position and requires:• Prolonged periods of sitting while working at a computer workstation.• Frequent use of hands and fingers to operate a computer, keyboard, mouse, telephone, and other standard office equipment.• Ability to view multiple monitors and analyze data for extended periods.• Effective verbal and written communication skills, including participation in virtual meetings and technical discussions.• Occasional travel for meetings, training, audits, or company events, as business needs require.• Ability to lift and carry up to 15 pounds, as needed.Statement to Third-Party Agencies