IT Cloud Engineer

• Windows Servers: Administer 200+ servers; own patching SLAs, monitoring (Prometheus/Grafana), capacity/lifecycle plans, and vulnerability remediations.
• Directory & Identity: Operate AD/Azure AD; serve as Okta–AD SSO/MFA integration owner (health, upgrades, certificates, lifecycle).
• Infrastructure & Migrations: Execute NYC data‑center app migrations; assist Nutanix decommission; administer Rubrik backups and Sectigo certificates.
• Monitoring & Reporting: Build dashboards and alerts; define SLOs with app owners; deliver monthly system inventory, ownership, and compliance reports.
• Networking & Peripheral Support: Manage enterprise DNS (non‑Route 53); support ClearPass and printer authentication integrations.
• Cloud Operations: Manage AWS/Azure/GCP workloads (VMs, IAM, storage/compute, networking, connectivity); optimize cost, reliability, and security.
• Automation: Deliver PowerShell/Python/Bash tooling for patching, configuration, and repetitive operations; champion IaC/Config‑as‑Code where feasible.

• Plan & governance: define scope/success/rollback, RFC/CAB approvals, stakeholder comms, risk register, clear ownership and SLAs.
• Baseline & readiness: full AD/GPO/OUs/trusts/DC health (dcdiag/repadmin), security posture (tiering/LAPS/NTLM), backups/DR tested.
• Identity & SSO design: source of truth + JML, AAD Connect (PHS/PTA, sourceAnchor, staging/writeback), Okta agents/MFA/policies, UPN/sAMAccountName strategy.
• App/data/network prep + pilot: catalog LDAP/Kerberos apps/SPNs, file/print ACLs, DNS/DHCP validation; run a scoped pilot with helpdesk scripts and rollback.
• Execute, monitor, cutover, close: wave-based moves with replication checks, live auth monitoring, cutover steps, post‑validation, cleanup/decommission, docs/CMDB updates, PIRs and metrics.

• Follow ITIL‑aligned change process: RFC tickets with peer review, test evidence, implementation/backout plans, and maintenance windows; attend CAB as required.
• Track changes in Jira; update CMDB/asset records within 7 days of change; complete PIRs within 5 business days for failed/high‑risk changes.
• Enforce progressive delivery: phased rollouts, canaries, and checkpoint validation; document rollback criteria and success gates upfront.

• Maintain current runbooks, architecture/network diagrams, standard operating procedures, DR playbooks, and “How We Operate” docs in a versioned repository.
• Treat documentation as acceptance criteria: every change/migration updates docs before closure; keep system ownership and escalation paths explicit.
• Publish weekly change summaries and quarterly service health reviews to stakeholders.

• Change quality: change failure rate ≤5%; PIR completion SLA met..
• CMDB accuracy: ≥98% CI correctness; ownership fields populated for 100% tier‑1 services.
• Observability coverage: dashboards/alerts for 100% tier‑1 apps with on‑call playbooks.
• Patch compliance: ≥95% critical within 14 days; ≥95% standard within 30 days.
• Backup posture: ≥99% successful jobs; quarterly restore tests with evidence.

• Plan migrations and decommissioning as small, testable increments with clear exit/rollback; demonstrate progress via bi‑weekly demos and burn‑up charts.
• Use feature flags/guardrails where applicable; prefer automate‑then‑standardize over one‑off fixes.
• Maintain a visible improvement backlog (automation debt, toil reduction, cost optimizations) with quarterly goals.

• 5+ years in systems administration or infrastructure engineering.
• Strong Windows Server and patch automation experience.
• Hands‑on with AWS, Azure, or GCP (IAM, compute/storage, networking).
• Deep knowledge of Okta, Active Directory, Azure AD integrations.
• Scripting with PowerShell (preferred), plus Python or Bash.
• Experience with Linux, Nutanix, Rubrik.
• Familiarity with Docker/containers.
• Monitoring/logging with Prometheus/Grafana, Loki, Splunk, or ELK.
• Excellent troubleshooting and stakeholder communication.
• Preferred: Cloud‑migration background, ITIL knowledge, Microsoft Administrator or cloud certifications.