Security, Documentation & Collaboration

• Operate infrastructure with a security-first approach, applying access controls, hardening and vulnerability remediation in line with company policies.
• Support logging, monitoring and security tooling, and assist with investigation and remediation of security alerts.
• Plan and deliver changes and project work through the RFC and release process, booking into agreed release windows and providing test, rollback and post-implementation evidence.
• Produce recurring operational and service reporting covering availability, capacity, patching, backup and security, and maintain accurate asset, licence and configuration records.
• Create and maintain clear technical documentation, runbooks and support procedures for new and existing solutions.

Technology Environment

The environment currently includes the following technologies. The list provides context for the role and is not intended to mean that experience in every technology is essential. The expectation is competence in several of these groups and the ability to pick up the rest.

Service delivery platform

• Oracle Linux and Windows operating systems across VMware vSphere, Proxmox and AWS
• Kubernetes and Docker, using MetalLB and Kong API gateway
• MySQL, Cassandra (Scylla), CockroachDB, Redis, Kafka, Elasticsearch, PostgreSQL and RabbitMQ
• Ansible and AWX, with scripting using Bash, Python or Perl
• TCP/IP networking, DNS, routing, VPNs, BGP, SMTP, HTTP and HTTPS
• Palo Alto firewalls; HAProxy, NGINX and dynamic DNS services
• Grafana, Prometheus, Graphite (ClickHouse), InfluxDB and Icinga, with alerting into OpsGenie
• ELK for application logging and Wazuh for platform host security monitoring
• Git, Bitbucket, Jira and Bamboo CI/CD pipelines
• iSCSI SAN, storage pools, volumes and snapshots
• AWS services including EC2, Route53, RDS, ELB, VPC, Multi-AZ subnets, VPN, Transit Gateway and Customer Gateway

Corporate IT

• Windows Server and Windows desktop estates, Active Directory, Group Policy, DNS, DHCP, DFS and file and print services with Linux (Ubuntu)
• Microsoft 365 and Entra ID, Intune, including Exchange Online, SharePoint, Teams, multi-factor authentication and Conditional Access
• VMware vSphere and vCenter, with Veeam Backup & Replication and object storage for offsite copies
• Endpoint management, patching and software deployment tooling, with BitLocker disk encryption
• CrowdStrike Falcon endpoint protection and UTMStack SIEM
• Palo Alto firewalls managed through Panorama, with GlobalProtect remote access
• LAN, wireless, VOIP and mobile telephony across multiple UK sites
• Puppet for configuration management and PowerShell for scripting, with Icinga and OpsGenie alerting shared across both estates
• Internal certificate services, TLS and PKI, split-horizon DNS, LDAP and Kerberos
• MS SQL behind business systems, plus the Atlassian suite, service desk, intranet and digital signage platforms

Essential Skills / Experience / Competency Required

• Strong problem solving, with the ability to pick up an unfamiliar system quickly, retain it, and carry what you learn across into unrelated parts of the estate. Recognising that a fault in one area has the same shape as one you solved somewhere else entirely is worth more here than depth in any single technology.
• Hands-on experience administering Linux in a production, business-critical environment, including fault diagnosis, performance management, patching and security hardening.
• Solid Windows Server administration, including Active Directory and Group Policy.
• Experience administering Microsoft 365 and Entra ID.
• A working understanding of TCP/IP networking, DNS, routing, VPNs and firewall policy: enough to establish whether a fault sits in the application, the host, or a rule upstream.
• A working understanding of Kubernetes and containerised services: enough to operate and diagnose them day to day. Deeper experience is welcome but not essential.
• Scripting and automation in at least one of Bash, Python or PowerShell, and a preference for putting configuration into version control rather than doing things by hand.
• Methodical, evidence-led troubleshooting: working from log, packet and configuration evidence rather than assumption, including faults that do not originate where they first appear.
• Clear written and verbal communication, with the ability to explain technical issues and risks to different audiences.
• A full UK driving licence is required, as occasional travel to data centres or other locations may be required to support IT and platform services.
• Participation in the team's 24x7 on-call rota, with flexible working outside normal hours where reasonably required to protect or restore critical services.

Desirable Skills / Experience

Platform and cloud

• Depth in Kubernetes administration, cluster operations and container networking.
• AWS, VMware or other virtualisation and cloud platforms.
• Databases in production, such as MySQL, PostgreSQL, MS SQL, Cassandra, Kafka or Elasticsearch.
• API gateway technologies such as Kong and measuring or reporting API performance.
• Telemetry, IoT, high-throughput data platforms or similarly critical real-time services.
• Storage, SAN and data centre experience covering physical security, networking and compute.

Corporate IT

• Endpoint management, software deployment and patching tooling such as PDQ, WSUS or Intune.
• Backup and recovery tooling such as Veeam, including restore testing.
• Providing IT support to end users directly, with the confidence to deal with colleagues at any level.

Automation and monitoring

• Configuration management with Ansible, Puppet or AWX.
• Monitoring, alerting and dashboarding with Icinga, Grafana, Prometheus or similar.
• Infrastructure-as-code, CI/CD tooling or automated testing for infrastructure changes.
• AI-assisted coding and automation tooling used to accelerate operational and scripting work.

Security and assurance

• Firewall policy administration, ideally Palo Alto, and load balancing or reverse proxy work.
• Endpoint protection, vulnerability management or SIEM platforms.
• System build following NIST standards, hardening, SELinux and server firewalls.
• Information security frameworks such as ISO 27001 or Cyber Essentials.

Ways of working

• Working within a formal RFC and change window process, including rollback planning and evidence.
• Moving live services off unsupported platforms and end-of-life operating systems without an outage.
• Disaster recovery, capacity planning and service continuity testing.

Personal Attributes

• Calm, methodical and solutions-focused, particularly when responding to live service issues.
• Takes ownership and follows actions through to resolution.
• Proactive in identifying risks, improvement opportunities and emerging capacity or resilience concerns.
• Security-conscious and careful when working with critical systems and customer data.
• Collaborative and