Systems Administrator

Position summaryThe Systems Administrator supports BPI's IT environment for 440–500 users across 14 locations, working under the direction of the IT Director. The role combines first and second-level help desk support with hands-on systems work: device management in Microsoft Intune and Entra ID, plus server, backup, and network support. This is a hands-on role for someone who wants to learn and grow. You will start with core support and device management, and take on more of the systems work, including automation, projects, and infrastructure, as your skills develop. We provide training, and we welcome experienced candidates as well as motivated earlier-career candidates with strong fundamentals. Key responsibilitiesIdentity and securitySupport Microsoft Entra ID: users, groups, device join and registration, and Conditional Access policies, and assist with admin role management. Support the company MFA program, including enrollment and troubleshooting for phishing-resistant methods (FIDO2 passkeys, Windows Hello for Business, and Platform SSO on macOS). Support on-premises Active Directory and Group Policy, and assist with hybrid identity between Active Directory and Entra ID. Assist with the internal PKI and certificate deployment to managed devices. Support endpoint security, including BitLocker, endpoint compliance and web filtering, and security baselines. Endpoint managementSupport Microsoft Intune for Windows, macOS, iOS, and Android: enrollment, configuration profiles, compliance policies, update rings, and security baselines. Maintain Windows Autopilot deployments, and provision new and replacement devices so they are ready on day one. Package, deploy, and patch applications (Win32, line-of-business, Store, and third-party) through Intune. Support Android Enterprise dedicated devices, including the warehouse scanner fleet (140+ devices), OEMConfig, and Managed Home Screen. Support iOS devices for drivers and field staff, including VPN configuration profiles. Track hardware inventory and lifecycle, and help plan device refresh cycles using Intune reporting. Pilot-test configurations, images, and policies before production rollout, following change management practices. Help desk and user supportProvide first and second-level support for help desk tickets, resolving common issues with hardware, software, phones, and network connectivity. Create, manage, and resolve tickets in Zendesk, and document solutions in the knowledge base. Escalate complex issues to the IT Director or Network Admin as needed. Use Pulseway RMM to monitor, patch, and support servers and endpoints. Take part in an on-call rotation for after-hours emergencies. Network and infrastructureAssist the Network Admin with Fortinet firewalls and the remote-access VPN, including monitoring, troubleshooting, and scheduled maintenance. Support UniFi wireless networks across all locations in partnership with the Network Admin. Support Windows Server and Hyper-V hosts: patching, monitoring, and routine maintenance. Support Datto backups: verify jobs, perform restores, and help maintain disaster recovery plans. Email and collaborationSupport Microsoft 365 and Exchange Online: mailboxes, permissions, shared and room resources, and licensing. Support the email security gateway and mail routing, including SPF, DKIM, and DMARC. Support conference room PCs, room accounts, and Microsoft Teams meeting spaces. AutomationWrite and maintain PowerShell scripts to automate configuration, remediation, and routine administration. Projects and documentationParticipate in IT projects, from scoping through rollout and handoff, and lead smaller tasks within them. Communicate project status and risks to the IT Director. Document systems, configurations, procedures, and changes in the IT knowledge base. Training and growthReceive training on the full environment, including Intune, Entra, backups, and networking, from the IT Director and team. Work toward Microsoft certifications (such as MD-102 and SC-300) with company support. Take on more advanced systems and engineering work as your skills develop. Technology environmentArea Platforms Identity and access Microsoft Entra ID, Active Directory, IDEE MFA, Entra PIM, SCEPman Endpoints Microsoft Intune, Windows Autopilot, Windows, macOS, iOS, Android Enterprise (Honeywell CK65) Security Conditional Access, FortiClient EMS, BitLocker, Mimecast Network FortiGate, IPsec (IKEv2) VPN, UniFi wireless Infrastructure Windows Server, Hyper-V, Microsoft Azure, Datto backup Email and collaboration Microsoft 365, Exchange Online, Microsoft Teams Service management Zendesk, Pulseway Required qualifications2+ years of IT support or systems administration experience in a Windows and Microsoft 365 environment. Candidates with less experience but strong fundamentals and hands-on Intune or Entra exposure will be considered. Working knowledge of Microsoft Intune and Entra ID (enrollment, policies, Conditional Access, MFA), gained on the job, in a lab, or through coursework. Working knowledge of Active Directory, Group Policy, and Windows Server. Working knowledge of PowerShell, or a willingness to learn it quickly. Clear written documentation and strong communication with both technical and non-technical staff. Strong troubleshooting and problem-solving skills, with the ability to work independently once trained. Willingness to travel to branch locations (10–15%) and take part in an on-call rotation. A degree in IT or a related field, or equivalent hands-on experience. Preferred qualificationsCertifications such as Microsoft MD-102, SC-300, or AZ-104, CompTIA Security+ or Network+, or Fortinet NSE/FCP. Hands-on experience with Windows Autopilot, application packaging, and compliance policies in Intune. Experience administering firewalls and VPNs, preferably Fortinet. Familiarity with Datto backups and UniFi wireless. Experience with Infor ERP or another distribution ERP, and with IBM i (AS400). Experience managing rugged Android devices or warehouse barcode scanners through Android Enterprise. Experience with enterprise email security gateways, and with SPF, DKIM, and DMARC. Experience managing macOS and iOS in Intune, including Platform SSO.