Senior Windows Infrastructure Engineer (AWS-Hosted, Remote)

Gresham Tech builds the financial infrastructure that keeps global markets running. Our platforms process billions of transactions for banks, hedge funds, central banks, regulators, and insurance companies — with an obsessive focus on data integrity, zero-downtime resilience, and regulatory precision.

• Operate genuinely complex Windows estates in regulated, high-stakes environments — not lift-and-shift.
• Be the senior technical voice for the Windows / Microsoft stack across the Managed Services Platform.
• Set the quality bar as an escalation authority — your judgement defines how incidents are resolved.
• Work alongside a talented cross-functional engineering team across global time zones.
• Access to Microsoft and AWS training, certifications, and industry conferences.

Job Purpose

As Senior Windows Infrastructure Engineer, you are the technical anchor for the Windows estate that powers Gresham's managed services platform — a multi-client environment hosted on AWS. The work is grounded in deep Windows Server operations: Active Directory, IIS, hybrid identity, Group Policy, PowerShell, certificate services, and the wider Microsoft ecosystem.

AWS is the platform on which all of this runs. Comfort with the cloud layer matters and you will operate it daily, but it is the Microsoft stack — and its operational nuance — that defines this role. We hire for deep Windows expertise first; the cloud layer is something a strong sysadmin can absorb.

You will be working US hours so please only apply if you are able to do so.

Role Responsibilities

• Lead resolution of complex Windows Server incidents across multi-client, AWS-hosted environments — from triage to root cause to remediation.
• Administer and harden Windows Server 2019/2022/2025: Active Directory (forest/domain design, replication, FSMO, GPOs, trusts), DNS, DHCP, IIS, WSUS, AD CS, file & print services.
• Operate hybrid identity: AD on-prem ↔ AWS Managed Microsoft AD, federation with Entra ID (Azure AD) / AD FS, SAML / OIDC / OAuth, Kerberos, MFA.
• Author and maintain PowerShell automation: bulk administration, scheduled tasks, configuration drift correction, reporting, and DSC where appropriate.
• Operate the AWS hosting layer for Windows workloads: EC2, EBS, VPC, IAM, Route 53, CloudWatch, Systems Manager (Patch Manager, Session Manager, Run Command), Backup, Directory Service.
• Manage IIS in depth: sites, application pools, bindings, ARR / URL Rewrite, SSL/TLS, failed request tracing, and performance tuning.

Interested in remote work opportunities in IT & Network Engineering? Discover IT & Network Engineering Remote Jobs featuring exclusive positions from top companies that offer flexible work arrangements.

• Drive observability of the Windows estate: event log strategy, performance baselines, CloudWatch metrics & alarms, Grafana dashboards.
• Author runbooks, SOPs, and knowledge base articles to codify operational standards.
• Participate in ITIL incident, problem, and change management; act as senior on-call escalation.

Essential Skills & Experience

Windows Server & Microsoft Infrastructure (Primary)

• 7+ years operating Windows Server in production, with deep hands-on experience on Windows Server 2019 and above.
• Active Directory at depth: forest/domain design, replication, FSMO roles, trusts, sites & services, schema, tombstone & recovery.
• Group Policy at scale: design, troubleshooting (RSoP, gpresult), security baselines, WMI filtering.
• IIS at depth: site & app pool configuration, ARR, URL Rewrite, SSL/TLS, failed request tracing, performance tuning.
• DNS, DHCP, WSUS, and Active Directory Certificate Services (AD CS) — real operational experience.
• Advanced PowerShell: scripting, modules, remoting, error handling, automation patterns, DSC familiarity.
• Windows patching at scale: planning, deployment, rollback, and troubleshooting in regulated environments.
• Windows performance troubleshooting: PerfMon, ETW, memory dump analysis, IIS request diagnostics.

Identity & Authentication

• Hybrid identity: AD on-prem ↔ cloud, Entra ID (Azure AD) Connect / federation, AD FS.
• SAML 2.0, OIDC, OAuth 2.0, Kerberos, LDAP, MFA — practical implementation and troubleshooting.
• Certificate management and PKI in enterprise Windows environments.

AWS Hosting Platform (Operational Competence)

• Day-to-day comfort operating Windows workloads in AWS: EC2, EBS, VPC, IAM, Route 53, CloudWatch.
• AWS Systems Manager for Windows fleet management: Patch Manager, Session Manager, Run Command, State Manager, Parameter Store.
• AWS Directory Service / Managed Microsoft AD / AD Connector.

Service Operations & Remote Working

• Strong ITIL grounding: incident, problem, change, and service lifecycle management.
• Prior experience in an MSP or shared-services environment — multiple client estates managed under SLA.
• Advanced / fluent professional English, written and spoken.

Working Hours, Remote Setup & Engagement

This role is 100% remote and 100% individual contributor. To match the responsiveness of an office-based engineer:

• Working hours: You will operate aligned to New York business hours (08:30–17:30 ET). Typical Brazil hours: 09:30–18:30 BRT during EDT (US summer) and 10:30–19:30 BRT during EST (US winter). You must be online, responsive, and actively engaged throughout core hours, the same as if you were sat with the team in the office.
• Home office: Quiet, ergonomic workspace with stable broadband (100 Mbps+ recommended), reliable power, and a professional video / audio setup. This is not a digital-nomad role.
• On-call: Participation in a senior escalation rota for major incidents — compensated in line with policy.

Equal Opportunities Statement

At Gresham, we are committed to building a diverse and inclusive workforce that reflects the communities we serve. We actively encourage applications from individuals of all backgrounds and are dedicated to providing a workplace where everyone feels valued, respected and supported.

We make employment decisions based on merit, skills and potential, and do not discriminate based on any protected characteristic. We are also committed to making reasonable adjustments throughout the recruitment process and employment lifecycle.