Systems Administrator

Capitolis; Newport Beach (CA); On-site; USD 90,000 - 110,000; Full time

Job summary

Capitolis is seeking a Systems Administrator to build and maintain servers, networks and platforms, ensuring patches are applied, vulnerabilities managed and backups are tested. The role emphasizes documenting the environment and responding to alerts in a controlled, auditable manner.

You will work with IT Operations to keep the infrastructure healthy, handle incident escalation, and maintain CMDB records while coordinating with adjacent IT teams and security professionals.

Responsibilities

• Provision, configure and maintain servers, networks and platforms
• Apply patches and manage vulnerabilities on schedule
• Monitor infrastructure and respond to alerts
• Run backups, restores and DR tests
• Resolve escalated incidents and raise changes
• Document systems and keep configuration records current

Job description

IT service delivery

SmartSuite for the Systems Administrator

The Systems Administrator builds and maintains servers, networks and platforms: provisioning, patching, monitoring, backups and the operational tasks that keep infrastructure healthy. They respond to alerts and escalated incidents and document the environment they run.

Reports to: IT Operations Director

What you own

The Systems Administrator builds and maintains servers, networks and platforms: provisioning, patching, monitoring, backups and the operational tasks that keep infrastructure healthy.

• Provision, configure and maintain servers, networks and platforms
• Apply patches and manage vulnerabilities on schedule
• Monitor infrastructure and respond to alerts
• Run backups, restores and DR tests
• Resolve escalated incidents and raise changes
• Document systems and keep configuration records current

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

IT Operations Director

Works closely with

• Service Desk Analyst
• DevOps Engineer
• Security Analyst
• IT Asset Manager
• IT Disaster Recovery Lead

How SmartSuite supports the Systems Administrator

The Systems Administrator keeps servers, networks and platforms healthy, answering to the IT Operations Director for patches applied, alerts handled and an environment that is documented as it is. SmartSuite puts routed alerts, linked configuration items and remediation tasks in one place, so work is recorded as it is done and the CMDB stays true.

Keep infrastructure healthy, patched and documented

Alerts that arrive with priority and context

Event & Alert Management routes alerts to you with priority and the service and dependency context behind them, and the action you take is recorded on the event. On-Call Management decides who gets the page, not the group inbox.

Patch windows met on the record

Patch and vulnerability remediation tasks are assigned by system, routed by criticality and tracked to closure with the Security Analyst's verification, so the PCI DSS, NYDFS or BOD 22-01 patch window is met on the record, not by recollection.

Maintenance windows on a calendar everyone can see

Planned maintenance, outages, changes and releases sit on one operations calendar visible to stakeholders, with each window having an owner and a status, so the DevOps Engineer's release and your patch cycle do not land on the same night by accident.

Work with the desk, security, DevOps and asset management

Starting on the fault, not the questions

Incidents escalated from the Service Desk Analyst arrive with the affected configuration item, the steps already taken and the user's contact, so you start on the fault rather than on the questions. Status flows back to the requester as you update.

CMDB updated as the change is made

Configuration records are updated against the asset and the Configuration Management (CMDB) entry as part of the change, with lifecycle status and ownership kept current, so the IT Asset Manager's register and your running environment describe the same estate.

Changes raised with the impact already assessed

Operational changes route through risk and impact review and approval when the dependency context says they need it, and audit-ready change history records who approved what and when. Raising a change is a form, not a negotiation.

Show the IT Operations Director what was done

No Friday status report from memory

Planned changes, outages, incident trends and operational KPIs are live dashboards over the same records you update, so the IT Operations Director sees what the team handled without a status report compiled from memory on a Friday.

Backups and DR tests on the record

Backups, restores and DR tests are recorded as operational events with outcomes, follow-ups and lessons learned captured afterwards, so the IT Disaster Recovery Lead's evidence that recovery was tested is the record you wrote when you ran it.

Control evidence auditors take from the activity history

Audit trails, version history and standardized tests give the Security Analyst and the auditor the evidence for configuration, patching, logging and backup controls under ISO 27001 or CIS, read from what you did rather than requested afterwards.

Monitoring event. Receives routed alerts with priority and context and records actions taken on each event.

Incident. Works escalated incidents with linked configuration items and changes.

Asset config. Updates configuration records as systems change so the CMDB stays accurate.

Security. Tracks patch and vulnerability remediation tasks by system to closure.

Products this role uses most

Event & Alert Management

Ingest and act on actionable alerts with automated routing, incident triggers, and real-time visibility across systems and services.

Explore this product

IT Incident Management

Detect and resolve IT incidents quickly with structured workflows, SLA tracking, and real-time visibility across systems and service operations.

Explore this product

Configuration Management (CMDB)

Track systems, applications, and dependencies in a CMDB that feeds incident, change, and service workflows.

Explore this product

Vulnerability Management

Identify, prioritize, and remediate vulnerabilities across systems and applications with automated workflows, SLA tracking, and real-time operational visibility.

Explore this product

On-Call Management

Manage on-call schedules, alert routing, and escalation workflows so the right responder is notified and incidents are handled within target times.

Explore this product

Industry reference

ITIL 4's infrastructure and platform management practice and vendor and CompTIA job families describe the work; the controls the administrator operates come from ISO/IEC 27001:2022 Annex A (configuration, patching, logging, backup), the CIS Benchmarks and NIST SP 800-53 for federal systems; CIS Controls v8.1 (June 2024) groups the same work under secure configuration, vulnerability management, log management and data recovery, and NIST SP 800-40 Rev. 4 (April 2022) is the patch management planning guide. Patch timelines are regulated in places: PCI DSS v4.0.1 Requirement 6.3, NYDFS 23 NYCRR 500 and FFIEC guidance in financial services, HIPAA's technical safeguards in healthcare, and BOD 22-01 remediation deadlines for US federal agencies.

Related roles

IT Operations Director

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The Systems Administrator looks after the infrastructure everything else runs on: provisioning, configuring and maintaining servers, networks and platforms, applying patches and managing vulnerabilities on schedule, monitoring and responding to alerts, running backups, restores and disaster recovery tests, resolving escalated incidents and raising changes, and documenting the systems so the configuration records are current. The controls they operate, from patching to backup to logging, are the ones ISO 27001 Annex A and the CIS Benchmarks describe.

Event & Alert Management delivers routed alerts with priority and context and records the actions taken on each event, so an alert reaches the Systems Administrator with its priority set and the system it concerns identified, and what was done about it is recorded against the event. On-Call Management routes it to whoever is on call. The record of actions is what the IT Operations Director reads when asking why a recurring alert keeps recurring.

IT Incident Management lets the Systems Administrator work escalated incidents with linked configuration items and changes, so an incident from the Service Desk Analyst arrives with the systems it affects and the recent changes to them, which is usually where the cause is. Configuration Management (CMDB) is updated as systems change, so the links are current and the fix the administrator makes is recorded against the configuration item. The IT Asset Manager and the IT Disaster Recovery Lead rely on that record staying accurate.

Vulnerability Management tracks patch and vulnerability remediation tasks by system to closure, so the Security Analyst's findings become tasks against the systems the Systems Administrator owns, each with a due date, and closing the task records the patch applied. The administrator sees their remediation queue by system; the Security Analyst sees that it closed. Where deadlines are regulated, as under PCI DSS Requirement 6.3 or BOD 22-01, the task record shows the date against the clock.

Through the records the work leaves behind: actions taken on each event, incidents resolved with their configuration items, changes raised and remediation tasks closed by system. The Systems Administrator does not write a weekly summary; the IT Operations Director reads the event, incident and remediation records as they stand and sees recurring alerts, aging remediation and the systems generating most work. The same records are the evidence an auditor asks for when testing patching, logging and backup controls.

The system inventory with owners, the on-call rotation, the alert sources with their severity scheme and the open remediation tasks. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for an infrastructure team the first workflow is the remediation queue with on-call routing, because those are where the audit pressure and the night-time pain both sit. Monitoring tools remain the source of alerts; SmartSuite is where an alert becomes a recorded event with an action.

See SmartSuite for your role

Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.