Senior Network & Systems Engineer

Evernet Systems Private Limited; Singapore; On-site; SGD 90,000 - 150,000; Full time

Benefits offered by this job

Quarterly bonus

On-call allowance

Full-time, permanent role

Job summary

Evernet Systems Private Limited in Singapore is seeking a senior hands-on engineer for networks and servers across our client base. You will handle Sev1 incidents, lead technical responses, and design scalable network and server setups for small and mid-size businesses, on-site or remotely.

You will review vendor advisories, maintain runbooks and baselines, and mentor L1/L2 engineers. The role includes working across security, backup, and Microsoft 365 at a practical level while coordinating

Qualifications

• Hands-on infrastructure experience across networks and servers.
• Lead Sev1 incident response and on-site support.
• Ability to design multi-site networks with VPN, SD-WAN, and server builds.
• On-call and night shift as required.

Responsibilities

• Take escalations from L1 and L2 engineers through to the fix.
• Lead the technical response in a Sev 1, remotely or on site.
• Open vendor TAC cases and own them until they close.
• Design networks and server set-ups for small and mid-size businesses: multi-site firewalls, VLAN plans, VPN and SD-WAN, server and virtualization builds.
• Review Microsoft 365 tenant-wide changes as requested.
• Write and maintain baselines for firewall, switch and server configuration; update runbooks.

Skills

Firewalls

Switching & Routing

Windows Server & AD

Microsoft 365 (L2)

Security hardening

Troubleshooting

Change control

Tools

Hyper-V

VMware

Veeam

Job description

Role summary

You are the senior hands‑on engineer for networks and servers across Evernet's clients, within the scope, service levels and runbooks Evernet sets. When a network or server problem goes beyond our L1 and L2 engineers, it comes to you, and you see it through to the fix. In a Sev 1 you lead the technical response, remotely or on site. You decide whether a non‑standard change is safe, you design networks and server set‑ups at the scale of small and mid‑size businesses, and you deliver projects. You set the standards our engineers work to, you watch for vendor security advisories before they become incidents, and you teach the engineers around you. Our clients' service levels range from business hours to 24x7. The role stops at people management, scheduling and client communication, which belong to the Service Delivery Manager, and at pricing, scope and spend, which need approval.

Key responsibilities

Escalations and major incidents

• Take network and server escalations from the L1 and L2 engineers and the NOC through to the fix. When it reaches you, it is yours
• Lead the technical response in a Sev 1, remotely or on site
• Open vendor TAC cases at any hour, and own them until they close
• Find the root cause of repeat faults, and see the preventive action through

Changes and design

• Review and approve non‑standard changes on networks and servers before they run: a backup first, a rollback plan and a check afterwards
• Stop a change that is not safe, and say what would make it safe
• Design networks and server set‑ups for small and mid‑size businesses: multi‑site firewalls, VLAN plans, VPN and SD‑WAN, server and virtualisation builds
• Review Microsoft 365 tenant‑wide changes, such as Conditional Access policies and mail flow, when asked to

Standards, documentation and vulnerability response

• Write and maintain Evernet's baselines for firewall, switch and server configuration, and check that clients' estates meet them
• Keep runbooks and IT Glue records current. Update a runbook within five business days of a new kind of fix
• Track security advisories from firewall and network vendors. Assess each critical one against our clients' equipment, and get exposed devices patched or mitigated under change control
• Keep the record of vendor support for critical client equipment current, and raise gaps with the Service Delivery Manager

Security incidents

• Contain the incident technically, following the security runbook: isolate hosts, block traffic at the firewall, disable accounts
• Work with the managed detection and response (MDR) security operations centre, which investigates
• Give the Service Delivery Manager the technical facts for client communication

Projects

• Design and deliver small and mid‑size infrastructure projects yourself: firewall and switch replacements, new sites and office moves, server and virtualisation migrations, backup deployments and security hardening
• On larger projects, own the technical design, approve the changes and be present for key cutovers, while L2 engineers deliver under your technical direction
• Scope and estimate the technical work on projects you will deliver
• Projects take about 30 to 40% of your time, in weeks when you are not on call. Incidents come first

Coaching

• Coach the L1 and L2 engineers on networks and servers: work faults with them, review their changes and explain your reasoning
• Grow what the L2 engineers can close without you

Skills required

Skills (required)

• Firewalls: enterprise next‑generation firewalls, such as Palo Alto Networks and Fortinet FortiGate. Policies, NAT, site‑to‑site and remote‑access VPN, security profiles, and HA pairs, including failover that does not behave. Expert in at least one platform, and willing to learn others
• Switching and routing: VLANs, trunks, spanning tree, link aggregation, stacked or redundant switches, static routing, and dynamic routing at a working level
• Servers: Windows Server, Active Directory, DNS, DHCP and Group Policy; virtualisation on Hyper‑V or VMware; backup and restore, for example with Veeam
• Microsoft 365 at L2 level: Entra ID users, groups and MFA; Exchange Online mail flow; Intune basics
• Security: hardening firewalls and servers (admin access, MFA on remote access, least‑privilege rules), and patching against published vulnerabilities
• Troubleshooting: from evidence, using logs, counters and packet captures
• Change control: standard, emergency and planned changes, each with a backup taken first and a rollback ready

Skills (preferred)

• Hands‑on with more than one firewall platform
• SD‑WAN and wireless design
• Failover clustering, and SAN or NAS storage
• Microsoft 365 security: Conditional Access and Defender
• Endpoint detection and response and MDR services, such as CrowdStrike or Huntress
• MSP tools such as HaloPSA, NinjaOne, LogicMonitor and IT Glue
• PowerShell or other scripting

Behaviours

• Clear spoken and written English, because you explain faults to clients and the NOC by phone, often at night, and write the ticket notes, designs and runbooks other engineers work from
• Calm and clear with client staff during an incident, including on site at night

The behaviours below are pass or fail:

• You write it down. The fix, the reasoning and the vendor case number go on the HaloPSA ticket, and the runbook is updated. If only you know it, it is not done.
• You back up before you change, and follow change control. No quiet changes.
• You say no to an unsafe change, whoever wants it tonight, and say what would make it safe.
• You call early. Open the vendor case before the clock runs out. Staying stuck on a Sev 1 in silence is a fail.
• You teach rather than take over. Outside a Sev 1, an engineer who brings you a problem leaves knowing more.
• You answer when you are on call. Cannot cover a week? Swap it before it starts.
• You keep to the access controls. Remote work on client systems goes only through the route each client requires. You never switch off MFA or open admin access to make a job easier.

Certifications

Required: none. We judge your skills by what you have done and by a practical test at interview.

Preferred:

• Cisco CCNA or CCNP Enterprise
• Fortinet NSE 4 or higher. A Fortinet Certified Professional (FCP) from the FortiGate or FortiOS Administrator exam now shows as NSE 4
• Palo Alto Networks Network Security Professional, Next‑Generation Firewall Engineer, or an active PCNSA or PCNSE
• A Microsoft associate certification, such as Azure Administrator (AZ-104), Endpoint Administrator (MD-102), Identity and Access Administrator (SC-300) or Windows Server Administrator
• Veeam Certified Engineer (VMCE)
• ITIL 4 Foundation

Experience and education

• Hands‑on infrastructure experience across networks and servers, typically five years or more. We judge it by what you have done:
  • you have led the technical response to a Sev 1 or P1 and restored service
  • you have been the engineer your team turned to when others were stuck
  • you have delivered an infrastructure project, such as a firewall or switch replacement or a server migration, with a change and rollback plan
• Helps, not required:
  • MSP experience, looking after many client estates at once
  • work on 24x7 service levels
  • coaching engineers
• A degree is not required

Working conditions

• Location: based in Singapore, because you go on site for faults that cannot be fixed remotely and for project work, across Singapore.
• Working hours: weekdays 09:00–18:00 SGT, when clients, the Service Delivery Manager and the engineers work.
• On call, on a rota with the other engineers, including nights, weekends and public holidays, because clients on 24x7 service levels need a fast restore:
  • technical on call: you answer the NOC within 15 minutes and work the fault remotely
  • onsite responder: you reach the site within 60 minutes at night when the fault needs hands
  • senior on call: second line behind the technical on call for Sev 1s on clients with 24x7 service levels, answering within 30 minutes
  • How a night call‑out is recovered the next day: to be confirmed.
• Site work: at client sites across Singapore. A driving licence is not required.
• Access: you reach client systems remotely only through Evernet's Singapore jump host or VDI, plus any further controls a client requires.
• Screening: some clients require security screening and a confidentiality undertaking before you work on their sites or systems. You must be able to pass it where a client requires it.
• Right to work: you need the right to work in Singapore, or must be eligible for a work pass.

Pay and benefits

• A quarterly performance bonus, tied to the role's measures and to the projects you deliver
• An on-call allowance and call‑out pay
• A full-time, permanent role