Systems & Security Engineer

Hong Kong International School; Hong Kong; On-site; HKD 600,000 - 900,000; Full time

Job summary

Hong Kong International School seeks a hands-on Systems & Security Engineer to implement, administer, and secure the School's IT infrastructure across on‑premises and cloud. You will manage Windows/Linux servers, AD/Azure/M365, VMware, SAN/backup, Juniper networks, Palo Alto firewalls, and endpoint management with Intune and Jamf Pro.

You will monitor security with SIEM/EDR/XDR, perform vulnerability remediation, and ensure disaster recovery readiness.

Qualifications

• Bachelor-level degree in a relevant field; professional certs preferred.
• Minimum 5 years hands-on experience in enterprise systems, networks, endpoints, or cybersecurity operations.
• Proven experience with Windows Server, Linux, AD, Azure, M365, Entra ID, VMware, SAN/storage, and Veeam backups.
• Hands-on design, implementation, and management of enterprise routing & switching with Juniper gear.
• Experience with Palo Alto, Cisco ISE, Jamf Pro, Intune MDM, SIEM/EDR/XDR, IDS/IPS, Check Point, vulnerability management, and security monitoring.
• Strong knowledge of TCP/IP, routing, switching, VLANs, DNS, DHCP, VPN, wireless, firewalls, and network security.

Responsibilities

• Implement, administer, and secure Windows Server, Linux, AD, Azure, M365, Entra ID, DNS, DHCP services.
• Manage VMware virtualization, SAN/storage, and Veeam Backup.
• Monitor availability and performance; perform upgrades, patching, hardening, and recovery.
• Support disaster recovery and infrastructure resilience.
• Design and manage LAN/WAN, routing, switching, VLANs, VPN, wireless, and Internet infrastructure.
• Administer Juniper equipment and enterprise routing/switching.
• Manage Palo Alto firewalls and Cisco ISE; enforce security policies.
• Oversee endpoint management with Intune MDM and Jamf Pro; enforce MFA and CA policies.
• Monitor SIEM/EDR/XDR, vulnerability management, logging, and security incidents.
• Document configurations, architectures, and procedures; coordinate with vendors; support professional development.

Skills

Windows Server

Linux

Active Directory

Azure

Microsoft 365

Entra ID

VMware

SAN/storage

Veeam

Juniper devices

Palo Alto firewalls

Cisco ISE

Jamf Pro

Microsoft Intune MDM

SIEM/EDR/XDR

IDS/IPS

Check Point

Vulnerability management

TCP/IP networking

Routing/Switching/VLAN

VPN/Wireless security

Education

University degree in Computer Science / Information Technology / Information Security / Computer Engineering

Relevant professional certifications preferred

Tools

VMware

Veeam Backup

Jamf Pro

Microsoft Intune

Microsoft 365

Entra ID

MS Defender EDR/XDR

Palo Alto firewalls

Cisco ISE

Juniper networking equipment

Job description

The Systems & Security Engineer is a hands-on technical role responsible for implementing, administering, maintaining, monitoring, and securing the School's IT infrastructure across on-premises and cloud environments. The role covers enterprise systems, virtualization, storage, backup, networking, firewalls, identity, endpoint management, and cybersecurity technologies to ensure reliable, secure, and resilient IT operations.

KEY AREAS OF RESPONSIBILITY:

Systems and Infrastructure

• Implement, administer, and maintain Windows Server, Linux, Active Directory, Azure, Microsoft 365, Entra ID, DNS, DHCP, and related infrastructure services.
• Manage VMware virtualization, SAN/storage infrastructure, and Veeam Backup.
• Monitor system availability, capacity, and performance; perform upgrades, patching, hardening, backup, recovery, and troubleshooting.
• Support disaster recovery and infrastructure resilience.

Network and Firewall

• Design, implement, administer, and troubleshoot enterprise LAN/WAN, routing, switching, VLAN, wireless, VPN, and Internet infrastructure.
• Manage Juniper networking equipment and enterprise routing and switching technologies.
• Implement and administer Palo Alto Networks firewalls, including security policies, NAT, VPN, segmentation, and logging.
• Administer Cisco ISE for network access control, authentication, and authorization.
• Monitor network availability, performance, capacity, and security and maintain network documentation.

Endpoint and Identity Management

• Manage Windows and supported endpoints using Microsoft Intune MDM.
• Support MacBook and Apple devices using Jamf Pro.
• Administer Active Directory and Entra ID identity and access controls, including MFA, SSPR, Conditional Access, and privileged access.
• Troubleshoot endpoint, identity, authentication, and device-management issues.

Security Operations

• Administer and monitor SIEM, Defender EDR/XDR, IDS/IPS, Check Point, vulnerability management, and other security platforms.
• Monitor and investigate security alerts, suspicious activities, phishing, malware, endpoint, identity, and network security incidents.
• Perform vulnerability scanning, remediation, patch management, and system/network hardening.
• Assist with security incident investigation, containment, remediation, and recovery, and maintain operational security documentation.

Projects, Documentation and Other Duties

• Evaluate, test, implement, and support infrastructure and cybersecurity technologies and participate in upgrades, migrations, and technology refreshes.
• Follow established change management procedures and maintain technical documentation, architecture diagrams, configurations, operational procedures, and recovery procedures.
• Coordinate with vendors and service providers for technical implementation and support.
• Take an active role in professional development and undertake other duties as required to support IT operations.

Other

• Undertake other duties and functions as required that will impact and strengthen the contributions of the department and overall operations of the school.

Minimum requirements and qualifications:

Education:

• University graduate with a degree in Computer Science, Information Technology, Information Security, Computer Engineering, or related discipline preferred.
• Relevant professional certifications are preferred.

Experience:

• Minimum 5 years of relevant hands‑on experience in enterprise systems, network infrastructure, endpoint management, or cybersecurity operations.
• Strong experience with Windows Server, Linux, Active Directory, Azure, Microsoft 365, Entra ID, VMware, SAN/storage, and enterprise backup solutions, preferably Veeam.
• Demonstrated experience designing, implementing, managing, and administering enterprise routing and switching networks, including hands‑on experience with Juniper equipment.
• Experience with Palo Alto Networks firewalls, Cisco ISE, Jamf Pro, Microsoft Intune MDM, SIEM, Defender EDR/XDR, IDS/IPS, Check Point, vulnerability management, and security monitoring.
• Strong knowledge of TCP/IP, routing, switching, VLANs, DNS, DHCP, VPNs, wireless, firewalls, and network security.

Certifications:

Network & Firewall

• Juniper JNCIA/JNCIS or higher; Palo Alto Networks professional‑level certification; Cisco CCNA.

Systems

• Relevant Microsoft Azure, Microsoft 365, Identity, Security or Endpoint certification; VMware VCP.

Cybersecurity

• CompTIA Security+, ISC² SSCP/CISSP, or relevant GIAC certification.

Candidates are not expected to hold all listed certifications; relevant hands‑on experience and certifications across multiple technical disciplines are preferred.

Required skills:

• Strong hands‑on troubleshooting and problem‑solving skills across systems, networks, endpoints, cloud, storage, and security technologies.
• Strong security‑focused approach to infrastructure administration, with good documentation, organization, and time‑management skills.
• Good written and verbal communication skills in English; Cantonese and Mandarin are also an advantage.
• Ability to work independently and collaboratively, handle confidential information professionally, and work outside normal office hours when required.
• Willing to work with and support our students and learning community.
• Intellectual flexibility, technical curiosity and a sense of humor, including the ability to learn independently.

Child Protection Statement:

At HKIS, each child's welfare is paramount. We act to ensure that our students enjoy the right to be protected from harm and exploitation and have their welfare safeguarded.