System Administrator II

QE Solar; Scottsdale (AZ); On-site; USD 80,000 - 100,000; Full time

Job summary

QE Solar is seeking a Systems Administrator II to join the Site Reliability Engineering team in Scottsdale. You will own platforms end-to-end, proactively identify issues, and lead incident containment with the team. The role emphasizes SOP-driven operations, security, and automation using PowerShell and Graph.

Required is 4+ years in IT systems or security operations, with experience at Tier 2 or above and a track record of training peers. On-site work in Scottsdale is expected.

Qualifications

• 4+ years in IT systems or security operations.
• Experience as Tier 2+ in an environment with hundreds of users.
• Proven track record training teammates.
• Built Intune baselines, Autopilot enrollment and CA policies.
• Incident lead on at least one security event.

Responsibilities

• Find problems proactively and fix before tickets are opened.
• Lead platform design, configuration baselines and health metrics.
• Design and build Intune compliance baselines, Autopilot profiles and CA policies.
• Lead P1 and security incidents through containment and RCA.
• Automate tasks with PowerShell and Graph in production.
• Draft SOPs and coach staff to run them.

Skills

IT systems

Security operations

PowerShell

Intune

Okta

Education

Bachelor's degree in IT or security

Tools

Jira Service Management

Confluence

Entra ID

Job description

QE Solar is one of the nation's largest independent solar and BESS operations and maintenance providers, with over 15 years of operating experience. We manage 10 GW of solar and 7.5 GWh of BESS across 44 states, supporting asset owners with multi-hundred MW utility solar projects and large standalone BESS systems. We're pure-play O&M. That focus means our entire organization is built around one thing: keeping solar and storage assets running well. Our technicians carry broad OEM certifications, and our in-house capabilities span MV/HV electrical, vegetation management, engineering, and capital improvements, to streamline asset management for project owners.

You'll join QE Solar's Site Reliability Engineering (SRE) team, which runs the corporate technology our office and field employees use every day: laptops, tablets and iPads, identity and sign-in, Microsoft 365, endpoint security and IT asset inventory.

For this team, reliability means four things:

• Devices are compliant and patched.
• Accounts are correct on an employee's first day and removed on their last.
• Security alerts are handled promptly, day or night.
• Every task is written down so someone else can run it.
• This is a systems and security operations role. It is not a cloud, Kubernetes or software engineering role.

The role:

• The Systems Administrator II is the escalation point behind our Service Desk.
• You go looking for problems and fix them before anyone reports them.
• You own platforms end to end.
• You resolve what Tier 1 cannot, and fix the cause, not only the ticket.
• You automate the manual work you find, in code others can run.
• You bring the team up with you: you teach what you know and help teammates get certified on the platforms they work on.
• Everything we run should live in a standard operating procedure (SOP). Team members certify on each SOP by running it with a teammate observing, so knowledge is shared and anyone can cover.

Endpoints: Windows laptops and tablets in Microsoft Intune with Autopilot; iPads in JAMF; patching through Intune update rings, manufacturer update tools and a remote monitoring and management (RMM) platform

• Identity: Okta (single sign-on for Microsoft 365, Device Access, Lifecycle Management) and Microsoft Entra ID

Security:

managed detection and response (MDR) with SIEM, privilege elevation, DNS filtering, and security awareness training

Service management:

Jira Service Management with Assets as the inventory of record, Confluence for SOPs, PagerDuty for on-call

Network:

firewalls and switching, owned by network engineering, but you are willing to step in to support when needed.

What you'll own:

• Finding problems first. Don't wait for tickets. Look through the systems you own for issues before they become tickets. Fix them, or bring a fix with its cost.
• Platform lead. Serve as lead for platforms we run. Own the design, configuration baselines, change records, SOPs and health metrics, and help teammates get certified on them. Support patch management across all of our environments, including restricted ones once authorized and trained.
• Design and build. Design and build Intune compliance and configuration baselines, Autopilot profiles, update rings and Conditional Access policies, plus Okta app integrations with SCIM provisioning and group rules.
• Incidents. Lead P1 and security incidents through containment, keep your lead informed, and write up the root cause and fix.
• Security alerts. Triage MDR, SIEM and phishing alerts. Contain threats to accounts and devices. Take your turn in the weekly after-hours on-call rotation.
• Automation. Write PowerShell and Microsoft Graph automation that runs in production on a schedule. Build it so others can run and maintain it, and document it so others understand it.
• Projects. Deliver projects end to end through change control, each with a plan, a change record and a tested rollback. Examples: platform migrations and onboarding acquired companies' users, devices and tenants. Work across the company with HR, finance, field operations, and our network, OT and product teams to plan the work, support their needs and land changes with the people they affect.
• Identity lifecycle. Automate joiner, mover and leaver changes across Okta and Entra, including license assignment by role and access reviews.
• Inventory. Keep our asset inventory accurate, and automate the reconciliation wherever you can.
• Escalations and coaching. Take Tier 2 tickets through to root cause. Turn repeat issues into SOP changes, and coach Service Desk staff and junior administrators to run them.

Your first 90 days:

• Day 30, learn and baseline: certified on the core SOPs; working the Tier 2 queue; shadowing on-call; your lead platforms assigned, with a health baseline for each.
• Day 60, deliver: primary on-call; one design change delivered on one of your platforms through change control; one PowerShell or Microsoft Graph automation running in production; patch ownership mapped across Intune, manufacturer tools and the RMM, with one source of truth for patch compliance; at least one problem found and fixed that no one had reported.
• Day 90, own and lead: led a tabletop exercise as incident lead; the full SOP set for your platforms current, with at least one teammate certified on it; a six-month roadmap for your platforms approved by the IT Operations Manager.

Required Experience:

• 4+ years in IT systems or security operations, including 2+ years at Tier 2 or above, in an environment of several hundred users or more
• A record of finding and fixing problems no one had reported, with specific examples and results
• A record of raising the people around you: teammates you trained or mentored into new skills and certifications, and knowledge you shared rather than kept
• Designed and built Intune compliance and configuration baselines, Autopilot enrollment and Conditional Access in a production tenant
• Built identity-provider integrations (Okta preferred): SAML or OIDC apps, SCIM provisioning, group rules and lifecycle automation
• Incident lead on at least one security incident, from detection through containment and post-incident review
• PowerShell (or an equivalent scripting language) automation running in production, using Microsoft Graph and vendor APIs, that you built and maintain, with scheduling, logging and error handling
• At least one infrastructure project delivered end to end through change control, such as an MDM, EDR or tenant migration
• SOPs you wrote that others run, and change records with tested rollback plans
• Available for the weekly after-hours on-call rotation
• Live within commuting distance of Scottsdale, AZ, or relocate before your start date. This role is on-site.

Preferred Experience:

• Microsoft MD-102 or SC-300, or CompTIA CySA+. We value certifications as a signal, but we hire and certify on demonstrated skill.
• Okta Workflows or Lifecycle Management; JAMF; an RMM platform
• Jira Service Management Assets or another CMDB
• Support for a distributed field workforce on tablets and mobile devices

Education:

Bachelor's degree in an IT or security field, or equivalent experience

Other requirements:

Authorized to work in the United States

ADA / Physical Demands

QE Solar is committed to providing equal employment opportunities and reasonable accommodations in accordance with the Americans with Disabilities Act (ADA) and applicable state and local laws. The physical and mental demands described below are representative of those required to successfully perform the essential functions of this position. Reasonable accommodations may be made to enable qualified individuals with disabilities to perform these essential functions.

an in office position and requires:

• Prolonged periods of sitting while working at a computer workstation.
• Frequent use of hands and fingers to operate a computer, keyboard, mouse, telephone, and other standard office equipment.
• Ability to view multiple monitors and analyze data for extended periods.
• Effective verbal and written communication skills, including participation in virtual meetings and technical discussions.
• Occasional travel for meetings, training, audits, or company events, as business needs require.
• Ability to lift and carry up to 15 pounds, as needed.

Statement to Third-Party Agencies

QE Solar accepts resumes only from contracted recruiting agencies with formal service agreements. Please do not send unsolicited resumes or outreach emails to QE Solar employees, hiring managers, or team members without expressed consent or contract for services. QE Solar is not responsible for any fees or charges associated with unsolicited resumes or services.

The pay range for this role is:

80,000 - 100,000 USD per year (Scottsdale)