System Administrator II

QE Solar is one of the nation's largest independent solar and BESS operations and maintenance providers, with over 15 years of operating experience. We manage 10 GW of solar and 7.5 GWh of BESS across 44 states, supporting asset owners with multi-hundred MW utility solar projects and large standalone BESS systems. We're pure-play O&M. That focus means our entire organization is built around one thing: keeping solar and storage assets running well.

Our technicians carry broad OEM certifications, and our in-house capabilities span MV/HV electrical, vegetation management, engineering, and capital improvements, to streamline asset management for project owners.

You'll join QE Solar's Site Reliability Engineering (SRE) team, which runs the corporate technology our office and field employees use every day: laptops, tablets and iPads, identity and sign-in, Microsoft 365, endpoint security and IT asset inventory.

• Devices are compliant and patched.
• Accounts are correct on an employee's first day and removed on their last.
• Security alerts are handled promptly, day or night.
• Every task is written down so someone else can run it.
• This is a systems and security operations role. It is not a cloud, Kubernetes or software engineering role.

• The Systems Administrator II is the escalation point behind our Service Desk.
• You go looking for problems and fix them before anyone reports them.
• You own platforms end to end.
• You resolve what Tier 1 cannot, and fix the cause, not only the ticket.
• You automate the manual work you find, in code others can run.
• You bring the team up with you: you teach what you know and help teammates get certified on the platforms they work on.
• Everything we run should live in a standard operating procedure (SOP). Team members certify on each SOP by running it with a teammate observing, so knowledge is shared and anyone can cover.

Endpoints:
Windows laptops and tablets in Microsoft Intune with Autopilot; iPads in JAMF; patching through Intune update rings, manufacturer update tools and a remote monitoring and management (RMM) platform

• Identity:
  Okta (single sign-on for Microsoft 365, Device Access, Lifecycle Management) and Microsoft Entra

managed detection and response (MDR) with SIEM, privilege elevation, DNS filtering, and security awareness training

Jira Service Management with Assets as the inventory of record, Confluence for SOPs, Pager Duty for on-call

firewalls and switching, owned by network engineering, but you are willing to step in to support when needed.

• Finding problems first. Don't wait for tickets. Look through the systems you own for issues before they become tickets. Fix them, or bring a fix with its cost.
• Platform lead. Serve as lead for platforms we run. Own the design, configuration baselines, change records, SOPs and health metrics, and help teammates get certified on them. Support patch management across all of our environments, including restricted ones once authorized and trained.
• Design and build. Design and build Intune compliance and configuration baselines, Autopilot profiles, update rings and Conditional Access policies, plus Okta app integrations with SCIM provisioning and group rules.
• Incidents. Lead P1 and security incidents through containment, keep your lead informed, and write up the root cause and fix.
• Security alerts. Triage MDR, SIEM and phishing alerts. Contain threats to accounts and devices. Take your turn in the weekly after-hours on-call rotation.
• Automation. Write Power Shell and Microsoft Graph automation that runs in production on a schedule. Build it so others can run and maintain it, and document it so others understand it.
• Projects. Deliver…