Senior MSP Engineer — Projects & Escalations (Remote)

You must complete the steps at the bottom of this posting to be considered. Applications without a resume AND a video will not be reviewed.

We're a small MSP based in Colorado. Our clients are mostly in healthcare, manufacturing, and compliance-focused companies who rely on us as their full IT department. 6 people on the team. We're growing and we need an experienced L3 engineer who can own project execution and take escalations off the rest of the team.

We're looking for someone who can take a project scope, think through the best approach, propose a solutions, write a project plan and run with it. Onboard a new client into our full service stack. Pick up a ticket that has already stumped another tea ---------- mber and drive it to resolution. Harden a Microsoft 365 tenant for a client pursuing SOC 2 compliance. Document everything thoroughly so the next person doesn't have to start from scratch.

We value first principles thinking and expert troubleshooting. When you encounter a situation you haven't seen before, we expect you to research it, think it through, suggest your approach, and execute once we align. You won't be following checklists. You'll be solving real problems across a diverse client base.

What you'll be doing

Escalations. You are the technical backstop for the team. Tickets that clear L1 and L2 land with you. Root cause, resolve, and write it up so it doesn't come back.

Project execution. Full client onboardings: RMM deployment, M365 tenant baselining, security hardening, service stack tooling, documentation buildout.

Microsoft 365 security and identity work. Conditional access policies, Entra ID configuration, compliance policies, DLP, MFA. This is the core of what we do and the deepest part of the role.

Intune and endpoint management. Enrollment, compliance policies, app deployment, Autopilot. Migrating endpoints from RMM-only management to Intune-managed. Apple Business Manager and Jamf for macOS environments.

Migration projects. Tenant-to-tenant, Google to M365, SharePoint, Quickbooks to QBO

Network and firewall configuration. IP schema design, VLANs, security policies, VPN setup, typically remote while a local tech racks hardware. Fortinet is our standard. UniFi for switching and wireless.

Automation and scripting. Building and maintaining scripts to streamline internal processes and client environments. You'll also work with AI development tools on internal systems projects.

Documentation of everything you touch in our internal knowledge base.

No two weeks look the same.

What we're looking for

3 to 5 years in an MSP environment at an L3 level. You've managed multiple client tenants simultaneously, worked within a PSA and ticketing system, and understand the pace and context-switching that comes with supporting a diverse client base.

Advanced Microsoft 365 administration and security experience. This is the most important qualification for this role. Not mailbox management. We mean conditional access design, Entra ID, identity governance, compliance policies, and knowing why a policy is scoped the way it is.

Real Intune proficiency. Enrollment, compliance baselines, app deployment, Autopilot. Comfortable migrating endpoints from RMM-only management into Intune-managed environments.

Cybersecurity proficiency. Conditional access policy design, security baselines, MFA enforcement, identity protection. Experience with HIPAA, SOC 2, or other compliance frameworks is important. We serve regulated industries and our clients depend on us to get this right.

Automation and scripting experience. PowerShell, bash, or similar. You look for ways to automate repetitive work in tools like your RMM, PSA, or other platform APIs. Experience with AI coding tools or workflow automation platforms is a strong plus.

Migration experience across different scenarios (tenant-to-tenant, Google Workspace, IMAP).

Networking is helpful, not required. If you have hands-on firewall configuration experience, especially Fortinet, that moves you up the list. If you don't, we'll pair you with our network lead and bring you along.

Strong documentation habits. If you didn't document it, it didn't happen.

Excellent written and spoken English. You'll be communicating with US-based tea ---------- mbers in Teams throughout the day and occasionally joining client calls.

First principles thinker. When something breaks or a project hits an unexpected turn, you research, reason through it, and come back with a recommended path forward.

Self-directed. You'll receive a scope of work and we expect you to execute it, flag blockers, and submit milestones for review without being managed step by step.

Hours

First 90 days: you work our hours. Full US Mountain Time business hours, roughly 8:00 AM to 5:00 PM MT. This is not negotiable and it is how we get you trained, integrated, and trusted with client environments.

After 90 days: minimum 4 hours of daily overlap with Mountain Time, with the rest of your schedule flexible.

Apply only if the first 90 days works for you.

Required within 90 days of hire:

Microsoft SC-300 (Identity and Access Administrator) and MD-102 (Endpoint Administrator). We cover exam fees and study materials. If you already hold either or both, that puts you ahead.

Nice to have
Experience with any of our toolstack: NinjaRMM, HaloPSA, Huntress, ImmyBot, CIPP, Hudu
Apple Business Manager and Jamf for macOS endpoint management
Fortinet NSE certification or equivalent
AI coding tools, workflow automation (n8n, Power Automate, or similar), or building internal tooling. We're an AI-forward team and actively building in this space
What we offer

Full-time remote. $1,500 to $2,000/month depending on experience and certifications. Permanent pay increases tied to certifications earned. Exam fees and study materials covered. Interesting project work across a diverse client base. A team that communicates well and trusts you to own your work.

This role starts with a 60-day trial period so we can both make sure it's a good fit.

How to apply

We're hiring immediately and will begin interviews within days of posting.

Please submit both of the following. Applications missing either one are automatically disqualified.

1. Your resume.

2. A short video, 5 to 8 minutes. Pick ONE of the scenarios below and walk us through your approach. Use examples from your actual experience where you can. We are looking at how you think and how you communicate.

-You're onboarding a 50-person company onto Microsoft 365. They're currently on Google Workspace. Walk us through your first two weeks: what do you do, in what order, and what are the gotchas you'd watch for?

-You're hardening a Microsoft 365 tenant for a client pursuing SOC 2 compliance. What conditional access policies do you implement first, and why in that order?

-A ticket has been escalated to you: users at one client intermittently can't authenticate to M365, and the L2 has already confirmed it isn't a password or MFA registration issue. Walk us through how you'd work it.

-A client needs a Fortinet firewall configured remotely. A local tech will rack it and give you console access. Walk us through how you'd plan the deployment: IP schema, VLANs, security policies, and what you'd document when you're done.