Senior Network & Systems Engineer

You are the senior hands-on engineer for networks and servers across Evernet's clients, within the scope, service levels and runbooks Evernet sets. When a network or server problem goes beyond our L1 and L2 engineers, it comes to you, and you see it through to the fix. In a Sev 1 you lead the technical response, remotely or on site. You decide whether a non-standard change is safe, you design networks and server set-ups at the scale of small and mid-size businesses, and you deliver projects. You set the standards our engineers work to, you watch for vendor security advisories before they become incidents, and you teach the engineers around you. Our clients' service levels range from business hours to 24x7. The role stops at people management, scheduling and client communication, which belong to the Service Delivery Manager, and at pricing, scope and spend, which need approval.

Key responsibilities

Escalations and major incidents

• Take network and server escalations from the L1 and L2 engineers and the NOC through to the fix. When it reaches you, it is yours
• Lead the technical response in a Sev 1, remotely or on site
• Open vendor TAC cases at any hour, and own them until they close
• Find the root cause of repeat faults, and see the preventive action through

Changes and design

• Review and approve non-standard changes on networks and servers before they run: a backup first, a rollback plan and a check afterwards
• Stop a change that is not safe, and say what would make it safe
• Design networks and server set-ups for small and mid-size businesses: multi-site firewalls, VLAN plans, VPN and SD-WAN, server and virtualisation builds
• Review Microsoft 365 tenant-wide changes, such as Conditional Access policies and mail flow, when asked to

Standards, documentation and vulnerability response

• Write and maintain Evernet's baselines for firewall, switch and server configuration, and check that clients' estates meet them
• Keep runbooks and IT Glue records current. Update a runbook within five business days of a new kind of fix
• Track security advisories from firewall and network vendors. Assess each critical one against our clients' equipment, and get exposed devices patched or mitigated under change control
• Keep the record of vendor support for critical client equipment current, and raise gaps with the Service Delivery Manager

Security incidents

• Contain the incident technically, following the security runbook: isolate hosts, block traffic at the firewall, disable accounts
• Work with the managed detection and response (MDR) security operations centre, which investigates
• Give the Service Delivery Manager the technical facts for client communication

Projects

• Design and deliver small and mid-size infrastructure projects yourself: firewall and switch replacements, new sites and office moves, server and virtualisation migrations, backup deployments and security hardening
• On larger projects, own the technical design, approve the changes and be present for key cutovers, while L2 engineers deliver under your technical direction
• Scope and estimate the technical work on projects you will deliver
• Projects take about 30 to 40% of your time, in weeks when you are not on call. Incidents come first

Coaching

• Coach the L1 and L2 engineers on networks and servers: work faults with them, review their changes and explain your reasoning
• Grow what the L2 engineers can close without you

Skills required

Skills (required)

• Firewalls: enterprise next-generation firewalls, such as Palo Alto Networks and Fortinet FortiGate. Policies, NAT, site-to-site and remote-access VPN, security profiles, and HA pairs, including failover that does not behave. Expert in at least one platform, and willing to learn others
• Switching and routing: VLANs, trunks, spanning tree, link aggregation, stacked or redundant switches, static routing, and dynamic routing at a working level
• Servers: Windows Server, Active Directory, DNS, DHCP and Group Policy; virtualisation on Hyper-V or VMware; backup and restore, for example with Veeam
• Microsoft 365 at L2 level: Entra ID users, groups and MFA; Exchange Online mail flow; Intune basics
• Security: hardening firewalls and servers (admin access, MFA on remote access, least-privilege rules), and patching against published vulnerabilities
• Troubleshooting: from evidence, using logs, counters and packet captures
• Change control: standard, emergency and planned changes, each with a backup taken first and a rollback ready

Skills (preferred)

• Hands-on with more than one firewall platform
• SD-WAN and wireless design
• Failover clustering, and SAN or NAS storage
• Microsoft 365 security: Conditional Access and Defender
• Endpoint detection and response and MDR services, such as CrowdStrike or Huntress
• MSP tools such as HaloPSA, NinjaOne, LogicMonitor and IT Glue
• PowerShell or other scripting

Behaviours

• Clear spoken and written English, because you explain faults to clients and the NOC by phone, often at night, and write the ticket notes, designs and runbooks other engineers work from
• Calm and clear with client staff during an incident, including on site at night

The behaviours below are pass or fail:

• You write it down. The fix, the reasoning and the vendor case number go on the HaloPSA ticket, and the runbook is updated. If only you know it, it is not done.
• You back up before you change, and follow change control. No quiet changes.
• You say no to an unsafe change, whoever wants it tonight, and say what would make it safe.
• You call early. Open the vendor case before the clock runs out. Staying stuck on a Sev 1 in silence is a fail.
• You teach rather than take over. Outside a Sev 1, an engineer who brings you a problem leaves knowing more.
• You answer when you are on call. Cannot cover a week? Swap it before it starts.
• You keep to the access controls. Remote work on client systems goes only through the route each client requires. You never switch off MFA or open admin access to make a job easier.

Certifications

Required: none. We judge your skills by what you have done and by a practical test at interview.

Preferred:

• Cisco CCNA or CCNP Enterprise
• Fortinet NSE 4 or higher. A Fortinet Certified Professional (FCP) from the FortiGate or FortiOS Administrator exam now shows as NSE 4
• Palo Alto Networks Network Security Professional, Next-Generation Firewall Engineer, or an active PCNSA or PCNSE
• A Microsoft associate certification, such as Azure Administrator (AZ-104), Endpoint Administrator (MD-102), Identity and Access Administrator (SC-300) or Windows Server Administrator
• Veeam Certified Engineer (VMCE)
• ITIL 4 Foundation

Experience and education

• Hands-on infrastructure experience across networks and servers, typically five years or more. We judge it by what you have done:you have led the technical response to a Sev 1 or P1 and restored serviceyou have been the engineer your team turned to when others were stuckyou have delivered an infrastructure project, such as a firewall or switch replacement or a server migration, with a change and rollback plan
• Helps, not required:MSP experience, looking after many client estates at oncework on 24x7 service levelscoaching engineers
• A degree is not required

Working conditions

• Location: based in Singapore, because you go on site for faults that cannot be fixed remotely and for project work, across Singapore.
• Working hours: weekdays 09:00–18:00 SGT, when clients, the Service Delivery Manager and the engineers work.
• On call, on a rota with the other engineers, including nights, weekends and public holidays, because clients on 24x7 service levels need a fast restore: technical on call: you answer the NOC within 15 minutes and work the fault remotely onsite responder: you reach the site within 60 minutes at night when the fault needs hands senior on call: second line behind the technical on call for Sev 1s on clients with 24x7 service levels, answering within 30 minutesHow a night call-out is recovered the next day: to be confirmed.
• Site work: at client sites across Singapore. A driving licence is not required.
• Access: you reach client systems remotely only through Evernet's Singapore jump host or VDI, plus any further controls a client requires.
• Screening: some clients require security screening and a confidentiality undertaking before you work on their sites or systems. You must be able to pass it where a client requires it.
• Right to work: you need the right to work in Singapore, or must be eligible for a work pass.

Pay and benefits

• A quarterly performance bonus, tied to the role's measures and to the projects you deliver
• An on-call allowance and call-out pay
• A full-time, permanent role

About Evernet

Evernet Systems is a managed service provider headquartered in Singapore, serving small and mid-size businesses across a range of industries. Our mission is to be the most valuable IT partner to our clients, delivering Managed IT, Secure IT and AI-augmented productivity. We are moving from a traditional MSP to a Managed Intelligence Provider (MIP), and we work with a growth mindset: 1% better every day.

Our brand promise: Productivity and Peace of Mind, Delivered.

Our core values. We are a lean team, and six values guide how we work:

1. Win-Win-Win or No Deal. Every decision must be a win for the customer, for Evernet and for the team. If it cannot be, we walk away.
2. Communicate Clearly, with Empathy and Compassion. We give context, listen before we respond, and seek to understand before we act.
3. Behave Like a Winner - Take Ownership and Be Accountable. Full responsibility for our tasks and decisions. No blame, no excuses. We win or we learn.
4. Growth Mindset with 1% Daily Improvement. Continuous learning and small improvements, every day.
5. Practise Zero Trust Towards IT Security. Every access request is verified. Security is a culture, not just technology.
6. Leverage AI Tools to Boost Productivity. We learn and apply AI in our daily work. It is how we work, not an option.

Evernet Systems is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.

How to apply

Apply through the link in this advert:
Your application is held in our recruiting system and handled in line with Singapore's Personal Data Protection Act. If your experience matches, we will invite you to a short first-round call.