Senior Windows Infrastructure Engineer (Cloud L2)

Senior Windows Infrastructure Engineer (Cloud L2)

Location: Lima, Peru

Type: Full-time

Job Summary

The Senior Windows Infrastructure Engineer is the technical anchor and senior escalation point for the Windows estate that powers the managed services platform, a multi-client environment hosted on AWS. The role owns complex incidents from triage through to root cause and fix, keeps the platform secure, patched and observable, and turns operational knowledge into runbooks and automation so that L1 can safely take on more of the routine work.

The work is grounded in deep Windows Server operations: Active Directory, IIS, hybrid identity, Group Policy, PowerShell, certificate services and the wider Microsoft ecosystem. The estate is Windows Server 2019 and above, end-to-end, with a negligible Linux footprint. AWS is the platform it all runs on and is operated daily, but it is the Microsoft stack that defines the role: we hire for deep Windows expertise first.

Responsibilities

• Incident escalation and resolution: Take L1 escalations in Jira Service Management and own complex Windows Server and AWS incidents from triage to root cause to remediation, across multi-client, AWS-hosted environments (approx. 3 L1 escalations per week, alongside own queue and project work).
• Major incidents and on-call: Cover the Primary on-call rota for P1/P2 incidents (senior escalation rota for major incidents, compensated in line with policy), usually one week a month. Lead the technical response during P1s and give technical updates to the Incident Manager and SDMs.
• Problem management: Carry out root-cause analysis on repeat or major incidents, raise problem records and follow fixes through to closure (roughly 3 problem management tickets a week).
• Windows platform administration: Administer and harden Windows Server 2019/2022/2025: Active Directory (forest/domain design, replication, FSMO, GPOs, trusts), DNS, DHCP, WSUS, AD CS, certificates and PKI, and file and print services.
• Hybrid identity: Operate hybrid identity between on-premises AD and AWS Managed Microsoft AD, federation with Entra ID (Azure AD) and AD FS, SAML, OIDC, OAuth, Kerberos and MFA. Support identity projects such as the Okta/SSO migration.
• IIS management: Manage IIS in depth: sites, application pools, bindings, ARR / URL Rewrite, SSL/TLS, failed request tracing and performance tuning.
• AWS hosting layer: Operate the AWS hosting layer for Windows workloads day to day: EC2, EBS, VPC, IAM, Route 53, CloudWatch, Systems Manager (Patch Manager, Session Manager, Run Command), AWS Backup and Directory Service.
• Vulnerability remediation and patching: Fix critical Windows and third-party vulnerabilities following the documented seven-stage remediation process. Plan, deploy, roll back and troubleshoot Windows patching at scale. Fix Tanium and Wiz cloud findings (including AWS security group findings) and own the third-party runbooks. Activity carried out most weekends.
• Observability: Drive observability of the Windows estate: event log strategy, performance baselines, CloudWatch metrics and alarms, and Grafana dashboards.
• Platform projects and migrations: Build and test changes for estate-wide programmes, for example the security-stack migration (Google SecOps agents on 2,000+ servers in 5 AWS accounts), the Grafana agent rollout and the Splunk-to-Grafana migration, and OS upgrades. Write the runbook and hand the work over to L1 once it becomes BAU.
• Automation: Write and maintain PowerShell and SSM automation for bulk administration, scheduled tasks, configuration drift correction and reporting, using DSC where appropriate.
• Changes: Plan, raise and carry out normal and emergency changes. Present them at the Cloud CAB and cover the Secondary (planned change) on-call rota, usually one week a month.
• Knowledge and L1 coaching: Write runbooks, SOPs and knowledge articles to codify operational standards. Run the daily ticket clinic with L1 and act as buddy for new L1 starters.

Eligibility Requirements

• 7+ years operating Windows Server in production, with deep hands-on experience on Windows Server 2019 and above
• Active Directory at depth: forest/domain design, replication, FSMO roles, trusts, sites and services, schema, tombstone and recovery
• Group Policy at scale: design, troubleshooting (RSoP, gpresult), security baselines, WMI filtering
• IIS at depth: site and app pool configuration, ARR, URL Rewrite, SSL/TLS, failed request tracing, performance tuning
• DNS, DHCP, WSUS and Active Directory Certificate Services (AD CS): real operational experience; certificate management and PKI in enterprise Windows environments
• Advanced PowerShell: scripting, modules, remoting, error handling, automation patterns, DSC familiarity
• Windows patching and vulnerability remediation at scale in regulated environments: planning, deployment, rollback and troubleshooting
• Windows performance troubleshooting: PerfMon, ETW, memory dump analysis, IIS request diagnostics
• Hybrid identity: AD on-premises ↔ cloud, Entra ID (Azure AD) Connect / federation, AD FS; practical implementation and troubleshooting of SAML 2.0, OIDC, OAuth 2.0, Kerberos, LDAP and MFA
• Day-to-day operation of Windows workloads on AWS: EC2, EBS, VPC, IAM, Route 53, CloudWatch; Systems Manager (Patch Manager, Session Manager, Run Command, State Manager, Parameter Store); AWS Directory Service / Managed Microsoft AD / AD Connector. Deep AWS architect-level expertise is not required.
• Strong ITIL grounding (incident, problem, change and service lifecycle management); prior experience in an MSP or shared-services environment managing multiple client estates under SLA; owns problems through to resolution
• Advanced / fluent professional English, written and spoken
• Able to work New York-aligned hours consistently, from a reliable, distraction-free home office with stable broadband (100 Mbps+ recommended), reliable power and a professional video and audio setup
• Nice to Have
  • Grafana/Prometheus, Splunk, Tanium, Wiz, Qualys
  • SQL Server on Windows; Terraform or Ansible; Git and CI/CD
  • Experience supporting financial services clients
  • AZ-800/801, SC-300, AWS SysOps or Solutions Architect Associate, ITIL 4 Foundation

How to Apply

• Click "Apply Now" to submit your resume through our career site
• Be sure to include any relevant experience that aligns with the role.
• Qualified candidates will be contacted by a member of our recruitment team for next steps

About eClerx

eClerx is a leading provider of productized services, bringing together people, technology and domain expertise to amplify business results.

The firm provides business process management, automation, and analytics services to a number of Fortune 2000 enterprises, including some of the world’s leading financial services, communications, retail, fashion, media & entertainment, manufacturing, travel & leisure, and technology companies. Incorporated in 2000, eClerx is traded on both the Bombay and National Stock Exchanges of India. The firm employs more than 19,000 people across Australia, Canada, France, Germany, Switzerland, Egypt. India, Italy, Netherlands, Peru, Philippines, Singapore, Thailand, the UK, and the USA.

For more information, visit www.eclerx.com

You can also find us on:

https://www.linkedin.com/company/eclerx/

https://www.indeed.com/cmp/Eclerx/about

https://www.glassdoor.com/eClerx

eClerx is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability or protected veteran status, or any other legally protected basis, in accordance with applicable law. We are also committed to protecting and safeguarding your personal data. Please find our policy here