IT Infrastructure Engineer (Operations) - Concord, CA

Infrastructure Engineer (Operations)

MSP4, LLC  |  Full-Time  |  Onsite (United States, posted location)  |  Up to 10% Regional Travel  |  4 to 6 Years Experience  |  Reports To: Service Desk Manager, with technical escalation to the Senior Infrastructure Engineer

About the Role

MSP4 operates as the embedded IT department for a portfolio of clients spanning professional services, legal, distribution, manufacturing, and government sectors. Environments range from 50 to 1,500 users, with CMMC L2, NIST 800-171, and SOC 2 as active requirements.

This role keeps running environments running. You own the server and platform layer in steady state: the escalations that pass above the endpoint and site tier, the patching and monitoring and health work that stops incidents from happening, and the day-to-day administration of Windows Server, virtualization, storage, backup, and Microsoft cloud across your assigned clients.

You are the technical ceiling of the support organization. L2 escalations land with you and stop there unless the answer is a design change — at which point they go to the Senior Infrastructure Engineer who owns that domain. Knowing which is which, and saying so rather than guessing, is most of the job.

This is an onsite role at a client facility in your posted location, with regional coverage for nearby MSP4 clients. You are in the environment every day, and that presence is the reason the role exists.

Infrastructure Engineer is a single tier with two specializations, Operations and Projects, sharing one compensation band and one core qualification set. If build and migration work fits you better, say so on your cover page.

What You Will Do

• Own L2 escalations at the server and platform layer: take what passes the endpoint and site tier, resolve it within scope, and escalate cleanly to the Senior Infrastructure Engineer when the fix is a design change rather than a repair
• Administer Windows Server environments day to day: Active Directory, DNS, DHCP, Group Policy, PKI, certificate services, and file and print services
• Operate Hyper-V and VMware vSphere clusters: VM lifecycle, capacity monitoring, host patching, live migration, HA behavior, and snapshot hygiene
• Run storage and clustering operations: provisioning, volume changes, capacity monitoring, and health checks against failover clustering and Storage Spaces Direct or comparable SAN/HCI platforms. Storage architecture sits with Senior Infrastructure Engineering
• Operate Veeam Backup and Replication: job management, backup verification, restore execution, repository and retention operations, and backup gap remediation
• Administer Microsoft 365 and Azure tenants: identity, licensing, Intune policy application, and Conditional Access within established standards
• Perform SQL Server platform work supporting client ERP and line-of-business applications: patching, version upgrades, backup coordination with Veeam, and baseline instance administration. DBA-level query tuning, indexing strategy, and application-side schema work sit with client DBAs or application vendors
• Execute network change at defined scope: firewall rule adds and modifications against approved standards, VLAN configuration, and switch port and access layer work. Routing, firewall policy design, and segmentation architecture sit with Senior Network Security Engineering — the stop-and-escalate boundary is stated, not guessed
• Apply STIG hardening and NIST 800-171 control execution at the server and platform layer in support of CMMC L2 and SOC 2, and capture the evidence
• Run the proactive work: patching cadence, monitoring coverage, health checks, capacity review, and closing the gap between a well-designed environment and a well-run one
• Receive completed projects into managed operations: review the handover, confirm the runbooks work, and own the platform from that point forward
• Communicate with client technical contacts and non-technical stakeholders on infrastructure work, change windows, and incidents
• Maintain ticketing and change discipline in a PSA or ITSM platform (Jira Service Management preferred; HaloPSA, ConnectWise, Autotask, or ServiceNow transferable)

Growth Path

This specialization is a full career position, not a waiting room. Engineers who want to move toward design ownership have two routes: across into the Projects specialization, which leads to senior domain ownership, or deeper into platform expertise within Operations. Both are supported, and movement between specializations does not require re-interviewing into the tier.

Qualifications Matrix

Candidates are scored against these. Rows 1 to 12 are the Infrastructure Engineer core, shared with the Projects specialization. Rows 13 to 17 are specific to Operations. Categories: Technical, Functional, Consulting, Credentials.

Eligibility & Scoring

Required. Absence screens the candidate out.

• US-based work location and US-person status (matrix #11). You must be based in the United States and qualify as a US person: US citizen, US national, lawful permanent resident (green card holder), or protected individual (refugee or asylee) under US law. Authorization to work in the United States is not sufficient on its own. A non-immigrant work visa (H-1B, L-1, TN, and similar), F-1 OPT/CPT, or an Employment Authorization Document does not meet this requirement. This role's access to Controlled Unclassified Information and export-controlled systems is restricted to US persons under CMMC L2 and US export control regulations (ITAR / EAR).
• Ability to work onsite at a client facility in the posted location (see Work Environment).
• 4 to 6 years operating production infrastructure in a multi-client service delivery environment (matrix #10).
• Hands-on Windows Server operational depth (matrix #1).
• Production virtualization operations on Hyper-V or VMware vSphere (matrix #2).
• Veeam Backup and Replication operations, including restores (matrix #4).
• Microsoft 365 and Azure tenant administration at a production level (matrix #5).
• Escalation ownership with a stated stop-and-escalate boundary (matrix #13).
• Audit-ready ticketing and documentation discipline (matrix #9, #16).

Preferred. Strengthens a candidate, never screens one out.

• Windows failover clustering and Storage Spaces Direct, or comparable SAN/HCI depth (matrix #3).
• Defined-scope network change: firewall rule changes, VLAN, and switch port work (matrix #15).
• SQL Server platform work supporting ERP or line-of-business applications (matrix #6).
• STIG and NIST 800-171 control execution with evidence capture (matrix #7).
• Citrix infrastructure operations.
• Prior multi-client or MSP service delivery experience (matrix #8).
• Certifications: AZ-104, AZ-800/AZ-801 or AZ-802, VMware VCP, or Veeam VMCE (matrix #12).

Core Competencies

How We Work

MSP4 does not operate like a traditional IT department or a ticket-centric help desk. We function as embedded IT leadership for our clients, accountable to their outcomes.

Our Principal Solutions Architect owns the design framework and the standards every environment runs on. Our senior engineers own design within their domain. Engineers at this tier operate within both, and grow into design ownership by demonstrating it on progressively larger scope. The tier structure keeps a multi-client portfolio consistent and audit-ready.

We investigate before we change, fix causes rather than symptoms, and measure success by stability, coverage, recoverability, and documentation rather than raw ticket counts. Incidents are expected to produce permanent remediation, improved monitoring, and corrected documentation — not heroics.

We are building the operating model in real time. Some processes are documented; others are being written as we go. People here help shape what does not yet exist while executing reliably within what does.

About MSP4

MSP4, LLC provides infrastructure, security, and IT advisory services to mid-market professional services, manufacturing, distribution, legal, and government clients across the United States. Our commercial practice and regulated practice serve organizations with serious compliance requirements including SOC 2 Type II and CMMC Level 2.

We are a small team. Every person on it has direct impact on client outcomes. The ladder is tiered for scope and audit; access is not. Everyone here has direct access to everyone else, up to and including the CEO.

Work Environment & Location

• Full onsite at a client facility in your posted location, within the United States, with regional coverage for nearby MSP4 clients where it applies.
• Up to 10% regional travel.
• Planned off-hours work for maintenance windows and patching is a normal part of the role.
• US-based work location and US-person status required. Work authorization alone (work visa, OPT/CPT, or EAD) does not qualify; see Eligibility & Scoring for the full definition.
• Extended periods at a computer performing configuration, operations, and documentation work; regular hands-on work in client server rooms and data closets.

Equal Opportunity Statement

MSP4, LLC is an equal opportunity employer. All qualified applicants receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.

How to Apply

Alongside your resume, submit a one-page cover page in PDF. Name the file CoverPage_LastName_FirstName_InfrastructureEngineerOperations.pdf. Include a header line with your name, the date, and the JD version string shown at the bottom of this posting.

Include the following eligibility confirmation, answered directly:

1. Are you currently based in the United States, and will you perform this role from within the United States?
2. Do you qualify as a US person as defined above — US citizen, US national, lawful permanent resident, or protected individual?

Then answer the following in order:

3. Describe the most complex escalation you have taken from a front-line tier in the last 12 months. What came up to you, what did you actually change, and what did you send back down so it would not come up again?
4. Describe a ticket you escalated upward even though it would have been faster to handle it yourself. What was the boundary that made you escalate, and how did that decision play out?

Close with the following statement exactly: "I understand that my scope is server and platform operations within the design owned by the Senior Infrastructure Engineer and the framework owned by the Principal Solutions Architect."

One page. PDF only. Applications missing the cover page, the eligibility confirmation, or the version string are not reviewed.

Other open positions at MSP4 are listed alongside this one.

JD v5.0. Retain this version string on your cover page.