Position title

Level 3 Windows Engineer

Location

Melbourne, Victoria

Job family

Information Technology, Infrastructure and End‑User Computing

Support tier

Level 3, internal escalation

Reports to

[To be confirmed]

Employment

Full Time

Scope

Internal operations and managed services clients

1. About Acquire Intelligence                                                                         

Acquire Intelligence™ delivers managed IT services and business process outsourcing to clients across Australia and internationally, through delivery teams in Australia and the Philippines.

Our managed services team supports several large clients alongside our own operations. The same engineers run our estate and our clients’ environments: more than 10,000 systems across multiple sites, multiple Active Directory forests and multiple Microsoft 365 tenants. Clients expect contracted service levels to be met, new users and sites to be live on the agreed date, and every outage to be handled as if it were our own business at stake. The business operates under PCI DSS, ISO/IEC 27001, SOC 1, SOC 2 and HIPAA, so every control on the Microsoft estate has to hold up in front of an auditor. That is the environment this role is built for.

2. The Role                                                                                                           

The Level 3 Windows Engineer is the senior technical authority for the Microsoft estate at Acquire Intelligence, from the agent’s desktop to the domain controller to the Azure subscription. When Level 1 and Level 2 have exhausted their options, this role takes the problem, finds the cause and removes it permanently.

This is not a ticket‑queue role. We want an engineer who sees problems through across the whole stack, makes sound decisions without waiting to be told, automates anything done twice, and leaves every environment more secure, better documented and easier to support than they found it. The role has broad autonomy and is expected to use it.

The position carries three equal weights: end‑user computing for internal staff, contact centre agents and client users; on‑premises infrastructure that is still the backbone of several sites; and cloud and hybrid identity across Microsoft 365, Entra ID and Azure. Depth in all three is the requirement, not a preference.

3. Key Responsibilities                                                                                     

3.1  End‑user computing

•  Engineer and maintain Windows 11 standard operating environments for Acquire Intelligence and client environments, including build standards, Autopilot provisioning, Intune configuration and compliance policy, and co‑management where ConfigMgr remains in use.

•  Package, deploy and maintain applications (Win32, MSIX and Store) and run update rings for Windows, Microsoft 365 Apps and drivers with defined pilot, validation and rollback stages.

•  Engineer agent workstations, shared and kiosk devices for contact centre operations.

•  Design and support physical desktop deployments for onshore and offshore staff, including image management, profiles, scaling, proactive maintenance and performance.

•  Deliver rapid, repeatable device provisioning so client onboardings, new sites and ramp‑ups go live on schedule without manual rebuilds.

•  Advance the end‑to‑end endpoint automation strategy, moving toward zero‑touch delivery across the full device lifecycle: Autopilot enrolment, configuration, application deployment, patching, compliance remediation and retirement, using Intune, PowerShell and Microsoft Graph to remove manual effort at every stage.

•  Enforce endpoint security baselines: BitLocker, Windows LAPS, Defender for Endpoint, attack surface reduction rules and application control.

3.2  On‑premises infrastructure

•  Engineer and administer Active Directory Domain Services across a multi‑site, multi‑forest environment, including trusts, sites and services, replication health, Group Policy, DNS and DHCP.

•  Lead domain controller and Windows Server lifecycle work: in‑place and side‑by‑side upgrades, promotion, decommissioning and full dependency analysis before any legacy server is retired.

•  Engineer and maintain the virtualisation, storage and file services layer (Hyper‑V and/or VMware, DFS, file server permissions), and Active Directory Certificate Services where in use.

•  Manage backup and recovery for Windows workloads: verify that backups complete, restores work and recovery objectives are met through scheduled restore and disaster recovery testing.

•  Diagnose complex faults using low‑level Windows tooling, including event tracing, performance counters, Sysinternals, network captures and memory dumps.

3.3  Cloud, hybrid identity and Microsoft 365

•  Engineer hybrid identity across Active Directory and Microsoft Entra ID, including Entra Connect or Cloud Sync, hybrid join, Conditional Access, multi‑factor authentication, Privileged Identity Management and role‑based access control.

•  Administer Azure infrastructure supporting Windows workloads: virtual machines, virtual networks, network security groups, site‑to‑site connectivity, storage, Azure Backup, Azure Arc, Update Manager and Azure Monitor.

•  Act as the Level 3 authority for Exchange Online, SharePoint Online, Teams and OneDrive, including complex mail flow, hybrid Exchange, permissions, retention and licensing issues.

•  Lead Windows workload migrations to Azure and recommend secure, supportable and cost‑aware designs.

•  Prepare the Microsoft 365 estate for AI tooling such as Microsoft 365 Copilot by fixing permissions hygiene, applying sensitivity labels and scoping app consent so AI features expose only what users are entitled to see.

3.4  Security hardening and compliance

•  Design and implement hardening standards across identity, servers and endpoints, aligned to the control requirements of PCI DSS, ISO/IEC 27001, SOC 1, SOC 2 and HIPAA, and to Microsoft security baselines.

•  Implement and maintain a tiered administration model, remove standing privilege, and retire legacy protocols and configurations including NTLMv1, SMBv1, RC4 Kerberos encryption and unconstrained delegation.

•  Implement and maintain the Windows, identity and endpoint controls within the compliance program: access reviews, privileged access, patch compliance, logging and retention, encryption and change records, with audit evidence that is complete, accurate and ready when requested.

•  Maintain segmentation and hardening for in‑scope environments, including cardholder data environments for payment‑handling contact centre operations and systems that process protected health information.

•  Support internal and external audits as the technical authority for the Microsoft estate, and remediate findings within agreed timeframes.

•  Drive vulnerability remediation to closure, and support security investigations and incident response by working with security and SIEM stakeholders on log analysis and containment.

3.5  Managed services delivery

•  Operate safely across multiple client tenants using delegated administration (GDAP), Microsoft 365 Lighthouse, RMM and PSA tooling, with strict separation between client environments.

•  Lead the technical components of client onboarding and offboarding, including discovery, tenant‑to‑tenant and forest migrations, directory synchronisation and cutover planning.

•  Deliver against client SLAs and contractual obligations, act as the technical lead with client stakeholders during major incidents, and contribute technical content to service reviews.

•  Present changes to the change advisory board with clear risk, testing, rollback and communication plans.

3.6  Automation, escalation and technical leadership

•  Automate administration, provisioning, monitoring and reporting with PowerShell and Microsoft Graph, using source control and peer review for anything that runs in production.

•  Act as the final internal escalation point for incidents across endpoints, servers, identity, Microsoft 365 and Azure, and see them through to resolution, including escalation to Microsoft and other vendors.

•  Lead problem management: run root cause analysis, write post‑incident reviews, and track permanent fixes to completion rather than accepting repeat incidents.

•  Maintain accurate technical documentation, including build standards, runbooks, known errors and recovery procedures, written so a Level 2 engineer can follow them at 2am.

•  Coach Level 1 and Level 2 engineers in Australia and the Philippines, review their technical work, and raise the capability of the team over time.

4. Knowledge, Skills and Experience                                                           

4.1  Essential

•  Typically seven or more years in Windows infrastructure and end‑user computing, including at least three years as a senior or Level 3 engineer in a managed service provider.

•  Proven delivery across multiple client environments at once: working to contracted SLAs, handling client‑facing escalations and maintaining strict separation between client tenants and credentials.

•  Experience onboarding new managed services clients, including environment discovery, remediation of inherited technical debt and tenant‑to‑tenant or forest migrations.

•  Experience operating and evidencing technical controls in an audited environment under PCI DSS, ISO/IEC 27001, SOC 2 or HIPAA.

•  Expert knowledge of Active Directory, Group Policy, DNS, DHCP and Kerberos, including troubleshooting replication and authentication failures from first principles.

•  Deep, hands‑on Intune and Autopilot experience at scale, including application packaging and update management.

•  Strong Windows Server engineering, virtualisation (Hyper‑V and/or VMware) and backup and recovery experience.

•  Proven Entra ID and hybrid identity experience, including Entra Connect, Conditional Access and privileged access management.

•  Level 3 capability in Exchange Online and Microsoft 365 administration.

•  Practical Azure IaaS administration experience, including networking and monitoring.

•  Advanced PowerShell, including Microsoft Graph, with a track record of building automation others rely on.

•  Working knowledge of TCP/IP, routing, VPN, firewalls and Wi‑Fi sufficient to isolate network causes of Windows faults.

•  Disciplined use of ITIL‑aligned incident, problem, change and knowledge management practices.

4.2  Desirable

•  Migration tooling such as Quest On Demand Migration, BitTitan MigrationWiz or ShareGate.

•  Microsoft CSP licensing and partner administration, and experience scoping and estimating client project work.

•  Contributing technical content to client service reviews and technology roadmaps.

•  Azure Virtual Desktop and FSLogix design and operations.

•  Infrastructure as code (Bicep or Terraform) and CI/CD pipelines for configuration and automation.

•  Defender XDR, Microsoft Sentinel or another SIEM at an investigation level.

•  Experience preparing a Microsoft 365 tenant for Copilot or other AI platforms, including data governance and app consent.

•  Exposure to contact centre environments, including CCaaS platforms such as Genesys Cloud, Amazon Connect or NICE CXone.

4.3  How we expect you to work

Technical depth gets an engineer to Level 3. The behaviours below separate an engineer who closes tickets from one the business relies on.

Behaviour

What it looks like in practice

Sees it through

Takes a problem from escalation to permanent fix without being chased, and closes the loop with the people affected.

Fixes causes, not symptoms

Treats a repeat incident as a defect. Finds the root cause, removes it and documents it.

Calm under pressure

Leads a P1 methodically: stabilises service first, communicates clearly, then investigates.

Automates by default

Scripts a task the second time it comes up, not the tenth, and makes the script safe for others to run.

Protects the estate

Will challenge a risky change or an insecure shortcut, explain why, and offer a workable alternative.

Translates clearly

Explains a Kerberos failure to an engineer and its business impact to a client operations manager in the same afternoon.

Raises the team

Shares knowledge freely, reviews work constructively and makes Level 1 and Level 2 more capable.

Client-minded

Remembers that every change lands in a client’s business. Keeps client stakeholders informed and represents Acquire Intelligence professionally.

Stays current

Keeps pace with Windows, Microsoft 365, Azure, security and AI tooling changes and brings useful ones to the team.

4.4  Qualifications and certifications

•  Tertiary qualification in information technology, computer science or a related discipline, or equivalent practical experience.

•  Current Microsoft certifications are highly regarded, particularly Endpoint Administrator (MD‑102), Windows Server Hybrid Administrator (AZ‑800/AZ‑801), Azure Administrator (AZ‑104), Identity and Access Administrator (SC‑300) and Microsoft 365 Administrator (MS‑102).

5. The First 90 Days                                                                                           

A strong Level 3 engineer is productive quickly. The milestones below set the expectation for the first three months.

Milestone

Expected outcome

Day 30

Completed discovery across internal and client environments; on the on‑call roster; reviewed open problem records and the current hardening backlog; built working relationships with Level 1 and Level 2 leads in both countries.

Day 60

Handling Level 3 escalations independently; delivered at least one automation or hardening improvement into production through change control; identified documentation gaps and closed the most critical.

Day 90

Recognised as the technical authority for the Microsoft estate; produced a prioritised list of the top technical risks with a remediation plan agreed with the manager; leading problem management for recurring issues.

6. What Success Looks Like                                                                           

Performance is assessed against the outcomes below. Specific targets are set with the manager and aligned to internal and client service level agreements.

Outcome area

Indicator of success

Service reliability

Windows, Microsoft 365 and Azure services meet agreed availability targets, and Level 3 escalations are resolved within SLA.

Repeat incidents

Recurring incidents fall over time because root causes are removed, not worked around.

Client onboarding

New clients, sites and users go live on schedule with working, compliant devices and identities.

Audit and compliance

Windows, identity and endpoint controls pass PCI DSS, ISO/IEC 27001, SOC 1, SOC 2 and HIPAA audits, evidence is delivered on time and findings are remediated within agreed timeframes.

Security posture

Vulnerabilities close within policy timeframes and legacy or insecure configurations are retired to plan.

Change quality

Changes are delivered with tested rollback plans and a low rate of failed or emergency changes.

Client confidence

Managed services clients receive clear technical leadership, accurate updates and dependable follow‑through.

Automation

Manual effort is measurably reduced through maintained, documented automation.

Team capability

Level 1 and Level 2 resolve more issues without escalation as knowledge and runbooks improve.

7. Working Arrangements                                                                                

The role participates in and carries out planned out‑of‑hours work for changes that cannot be made during operating hours. It works closely with delivery teams in the Philippines across time zones, and occasional travel to client and delivery sites may be required. Appointment is subject to satisfactory background and police checks, consistent with client and contractual requirements.

Join the A-Team and experience the A-Life!