Senior Windows Infrastructure Engineer (Cloud L2)

Senior Windows Infrastructure Engineer (Cloud L2)

Location: Lima, Peru

Type: Full-time

Job Summary

The Senior Windows Infrastructure Engineer is the technical anchor and senior escalation point for the Windows estate that powers the managed services platform, a multi-client environment hosted on AWS. The role owns complex incidents from triage through to root cause and fix, keeps the platform secure, patched and observable, and turns operational knowledge into runbooks and automation so that L1 can safely take on more of the routine work.

The work is grounded in deep Windows Server operations: Active Directory, IIS, hybrid identity, Group Policy, PowerShell, certificate services and the wider Microsoft ecosystem. The estate is Windows Server 2019 and above, end-to-end, with a negligible Linux footprint. AWS is the platform it all runs on and is operated daily, but it is the Microsoft stack that defines the role: we hire for deep Windows expertise first.

Responsibilities

Incident escalation and resolution: Take L1 escalations in Jira Service Management and own complex Windows Server and AWS incidents from triage to root cause to remediation, across multi-client, AWS-hosted environments (approx. 3 L1 escalations per week, alongside own queue and project work).

Major incidents and on-call: Cover the Primary on-call rota for P1/P2 incidents (senior escalation rota for major incidents, compensated in line with policy), usually one week a month. Lead the technical response during P1s and give technical updates to the Incident Manager and SDMs.

Problem management: Carry out root-cause analysis on repeat or major incidents, raise problem records and follow fixes through to closure (roughly 3 problem management tickets a week).

Windows platform administration: Administer and harden Windows Server 2019/2022/2025: Active Directory (forest/domain design, replication, FSMO, GPOs, trusts), DNS, DHCP, WSUS, AD CS, certificates and PKI, and file and print services.

Hybrid identity: Operate hybrid identity between on-premises AD and AWS Managed Microsoft AD, federation with Entra ID (Azure AD) and AD FS, SAML, OIDC, OAuth, Kerberos and MFA. Support identity projects such as the Okta/SSO migration.

IIS management: Manage IIS in depth: sites, application pools, bindings, ARR / URL Rewrite, SSL/TLS, failed request tracing and performance tuning.

AWS hosting layer: Operate the AWS hosting layer for Windows workloads day to day: EC2, EBS, VPC, IAM, Route 53, CloudWatch, Systems Manager (Patch Manager, Session Manager, Run Command), AWS Backup and Directory Service.

Vulnerability remediation and patching: Fix critical Windows and third-party vulnerabilities following the documented seven-stage remediation process. Plan, deploy, roll back and troubleshoot Windows patching at scale. Fix Tanium and Wiz cloud findings (including AWS security group findings) and own the third-party runbooks. Activity carried out most weekends.

Observability: Drive observability of the Windows estate: event log strategy, performance baselines, CloudWatch metrics and alarms, and Grafana dashboards.

Platform projects and migrations: Build and test changes for estate-wide programmes, for example the security-stack migration (Google SecOps agents on 2,000+ servers in 5 AWS accounts), the Grafana agent rollout and the Splunk-to-Grafana migration, and OS upgrades. Write the runbook and hand the work over to L1 once it becomes BAU.

Automation: Write and maintain PowerShell and SSM automation for bulk administration, scheduled tasks, configuration drift correction and reporting, using DSC where appropriate.

Changes: Plan, raise and carry out normal and emergency changes. Present them at the Cloud CAB and cover the Secondary (planned change) on-call rota, usually one week a month.

Knowledge and L1 coaching: Write runbooks, SOPs and knowledge articles to codify operational standards. Run the daily ticket clinic with L1 and act as buddy for