Tier 3 Engineer

The Tier 3 Engineer is the senior-most technical escalation point within our Managed Services team. The role owns three things: resolution of the incidents Tier 1 and Tier 2 cannot close, formal problem management and root-cause elimination on recurring issues, and the technical standards that govern how our managed client environments are built and secured.

The role also serves as design authority on client projects and net-new implementations reviewing and approving solution design, scope, and cutover planning, and taking hands‑on lead on a bounded number of high‑complexity builds each year. Day‑to‑day project delivery is owned by the project and implementation team so that escalation response is not compromised.

The ideal candidate combines deep expertise across Microsoft cloud and on‑premises infrastructure, networking, and security with the communication skills to explain a problem and its remedy to a business owner, and is comfortable operating with a high degree of autonomy across many client environments.

• Serve as the final technical escalation point for complex, high‑severity, and recurring incidents raised by Tier 1/Tier 2 engineers, the NOC, and monitoring alerts.
• Own formal problem management: perform root‑cause analysis on recurring and systemic issues, implement permanent fixes rather than workarounds, and close the loop by updating monitoring, automation, and documentation so the issue cannot recur unnoticed.
• Lead technical response for major incidents multi‑user or multi‑site outages, core network and identity failures, and security events including account compromise, business email compromise, and ransomware covering containment, recovery, and post‑incident review.
• Actively reduce escalation volume at the source: identify what is reaching Tier 3 that should have been resolved one tier down, then close that gap with tooling, automation, documentation, or targeted training.
• Meet response and resolution SLA targets on high‑severity escalations, and maintain accurate, auditable ticket notes and time entry.

• Own the technical standards for supported client environments reference configurations, security hardening baselines, backup and recovery standards, and documentation conventions, and drive environments that have drifted back to standard.
• Design and maintain identity and access architecture across client tenants:
  Entra , Conditional Access, MFA and passwordless, privileged access, and least‑privilege models.
• Own the security engineering side of the stack: EDR/XDR deployment and tuning, Microsoft Defender configuration, email security, patch management, and vulnerability remediation.
• Design, deploy, and maintain core client infrastructure:
  Windows Server, Active Directory, Microsoft 365, Azure, virtualization (Hyper‑V and/or VMware), and backup and disaster recovery.
• Configure and maintain network infrastructure across client sites: firewalls, switching, routing, VPN, wireless, and SD‑WAN or SASE where deployed.
• Verify that backup and disaster recovery actually work scheduled restore testing, immutable or air‑gapped copies, documented RTO/RPO per client, and recovery runbooks that someone else can execute.
• Support client security reviews, cyber‑insurance attestations, and compliance evidence requests relevant to client verticals (HIPAA, CMMC/NIST 800‑171, PCI‑DS, CIS benchmarks).

• Act as design authority on net‑new client implementations and major infrastructure projects: review and approve solution design, scope, dependencies, and cutover and rollback planning.
• Provide technical review and risk assessment during pre‑sales and scoping alongside sales and project…