IT Systems Administrator

Union-Community-Care; Lancaster (Lancaster County); On-site; USD 90,000 - 120,000; Full time

Job summary

Union Community Care is seeking a seasoned tech­nician with hands-on expertise in Microsoft identity, endpoint, and cloud administration to manage our hybrid environment. The role focuses on AD, GPOs, M365, Azure tenant operations, Intune/MDM, identity governance, and security controls.

The ideal candidate solves problems pragmatically, designs and troubleshoots complex Microsoft-centric infrastructure, and collaborates with security, networking, and operations teams.

Qualifications

• 5+ years of hands-on experience administering Active Directory and Group Policy in production environments.
• Experience managing Microsoft 365 tenants and Azure AD / Entra ID (including hybrid identity).
• Proficient in PowerShell scripting to automate AD, Entra ID, M365, and Intune tasks.
• Experience with Microsoft Intune / Endpoint Manager and MDM.

Responsibilities

• Administer and maintain on-premises Active Directory domains and GPOs.
• Design, test, deploy, and troubleshoot GPO configurations for security baselines and software deployment.
• Write and optimize PowerShell scripts for automation across AD, Entra ID, M365, and Intune tasks.
• Manage Microsoft 365 tenants: Exchange Online, SharePoint Online, Teams, OneDrive, and licensing.
• Administer Azure AD / Entra ID users, groups, app registrations, and conditional access.
• Own Intune / Endpoint Manager and MDM operations: enrollment, profiles, compliance, Autopilot.
• Support identity lifecycle management, SSO, MFA, and passwordless initiatives.
• Implement and monitor DLP policies across Microsoft 365.
• Collaborate with security, networking, and operations teams on identity and endpoint projects.
• Document configurations, runbooks, and participate in change management.

Skills

Active Directory

Group Policy

PowerShell

Azure AD / Entra ID

Intune / Endpoint Manager

MDM

Conditional access

MFA

Data Loss Prevention (DLP)

Cybersecurity best practices

Troubleshooting complex issues

End-user / admin communication

Tools

Microsoft Defender

Microsoft Sentinel

AD CS / PKI

Entra ID

Job description

Our Mission, Vision, & Model of CareAt Union Community Care, our purpose is at the forefront of all that we do: we stand for whole health to help you live your fullest life.We envision vibrant and healthy communities supported by inclusive healthcare that embraces each member’s unique culture, needs, and values, and emboldens them to make healthful choices that fuel their well-being and the well-being of others.We believe in whole health. This means we address and heal disease but equally important, we work at the causes of the causes, the social ills that must be addressed to achieve true equity.We listen, learn, and embrace the complex lives and unique strengths of our patients, and we work hard to break down all barriers to care. This means we look through a grassroots lens. We connect with our communities because we are our communities. Each of us is a neighbor, a friend, a family member, and together, we are a trusted community health center.JOB SUMMARYWe are seeking a seasoned technician with deep hands-on expertise in Microsoft identity, endpoint, and cloud administration to manage and secure our hybrid environment. This role focuses on Active Directory, Group Policy, Microsoft 365, Azure tenant operations, Intune/MDM, identity governance, and related security controls. The ideal candidate is a pragmatic problem-solver who can design, implement, maintain, and troubleshoot complex Microsoft-centric infrastructure while collaborating with security, networking, and operations teams. Healthcare/Epic experience a plus, but not required.SPECIFIC JOB DUTIESAdminister and maintain on-premises Active Directory (AD) domains, including user/computer object management, OU design, Group Policy Objects (GPOs), and replication health.Design, test, deploy, and troubleshoot Group Policy configurations for security baselines, software deployment, and configuration management.Write, maintain, and optimize PowerShell scripts and modules for automation of AD, Azure AD / Entra ID, Microsoft 365, and Intune tasks.Manage Microsoft 365 tenants: Exchange Online, SharePoint Online, Teams, OneDrive, licensing, and service health.Administer Azure AD / Microsoft Entra ID (users, groups, app registrations, conditional access, PIM, identity protection, hybrid identity with Entra Connect).Own Intune (Microsoft Endpoint Manager) and MDM operations: device enrollment, configuration profiles, compliance policies, application deployment, and Autopilot.Support identity lifecycle management, single sign-on (SSO), multifactor authentication (MFA), and passwordless initiatives.Implement and monitor Data Loss Prevention (DLP) policies across Microsoft 365 and related platforms.Assist with network-related aspects of identity and endpoint management (DNS, DHCP, VPN, certificate services, firewall rules affecting authentication and device connectivity).Contribute to cybersecurity posture through hardening of AD/Azure AD, privileged access management, logging/monitoring (including Microsoft Defender and Sentinel where applicable), and response to identity-related incidents.Document configurations, procedures, and runbooks; participate in change management and after-hours support as needed.Collaborate with support, networking, and application teams on projects involving identity, endpoints, and cloud services.Performs other work-related duties as assignedPOSITION REQUIREMENTS5+ years of progressive hands-on experience administering Active Directory and Group Policy in production environments.Strong PowerShell scripting skills with proven ability to automate AD, Entra ID, Microsoft 365, and Intune tasks.Demonstrated experience managing Microsoft 365 tenants and Azure AD / Entra ID (including hybrid identity scenarios).Practical experience with Microsoft Intune / Endpoint Manager and mobile device management (MDM).Working knowledge of identity and access management principles, conditional access, MFA, and privileged identity management.Familiarity with Data Loss Prevention (DLP) concepts and Microsoft 365 compliance tools.Understanding of core networking concepts relevant to identity and device management (DNS, certificates, VPN, firewalls).Solid foundation in cybersecurity best practices for identity, endpoints, and hybrid environments.Ability to troubleshoot complex issues across on-premises, hybrid, and cloud Microsoft stacks.Clear written and verbal communication skills; ability to document technical work and explain issues to both technical and non-technical audiences.Ability to work independently and collaboratively in a fast-paced environment.Occasional after-hours work required for system maintenance and emergency response.PREFERRED QUALIFICATIONSMicrosoft certifications such as AZ-104, MS-102, SC-300, MD-102, or equivalent practical experience.Experience with Microsoft Defender for Endpoint / Identity, Microsoft Sentinel, or similar security tooling.Exposure to certificate services (AD CS / PKI), Entra ID app proxy, or advanced conditional access scenarios.Familiarity with other identity or MDM platforms (e.g., Okta, Jamf) as complementary knowledge.Experience in regulated or highly secured environments (compliance frameworks such as NIST, CIS, and HIPAA requirements).Scripting beyond PowerShell (e.g., Graph API, Azure CLI, or basic Python) is a plus.ESSENTIAL FUNCTIONSIn order to fulfill the requirements of this position, duties 1-13 are considered essential functions of the job.ORGANIZATIONAL INVOLVEMENTThis position is required to participate in mandatory all staff meetings, team meetings and trainings.