Senior Microsoft Infrastructure & Exchange Engineer

Own the health, security, and continuity of the organisation's core Microsoft platform: Exchange Server 2019 (on-premises) in hybrid with Microsoft 365, Active Directory, Group Policy, DNS/DHCP, and the identity and email-security layers that sit on top of them. The role helps maintain reliable corporate messaging, mailbox availability, and identity services in a multi-site business environment.KEY ResponsibilitiesCore: Microsoft Exchange (on-premises + hybrid) Install, configure, administer, and upgrade Microsoft Exchange Server 2019 on-premises; apply cumulative updates and security patches on a controlled schedule Run and maintain Exchange Hybrid with Microsoft 365: hybrid configuration, free/busy, cross-premises mail flow, and directory synchronisation health Execute mailbox migrations (on-prem to/from Exchange Online) with zero-data-loss cutovers and a tested rollback for each wave Manage mailbox lifecycle, distribution and shared mailboxes, mail flow, transport rules, send/receive connectors, and certificate lifecycle (issuance, renewal, binding) with no lapsed-certificate outages Design, build, and maintain Database Availability Groups (DAG) for Exchange high availability; own failover testing and quorum health Diagnose and resolve complex mail-delivery, queue, performance, and availability problems using message tracking, protocol logs, and transport diagnosticsCore: Active Directory & Group Policy Perform advanced Active Directory administration: domain services, sites, trusts, OU design, delegation, user authentication, and permissions Design, implement, troubleshoot, and optimise Group Policy (GPO): scope, precedence, security filtering, and drift control Administer and maintain DNS and DHCP as authoritative infrastructure services for the estate Own AD replication health, security hardening (privileged accounts, tiering), and disaster-recovery readiness for the directory (backup, forest/domain recovery runbook, tested restore)Core: Email Security Administer the enterprise email-security gateway/solution: anti-spam, anti-phishing, malware protection, content filtering, quarantine management, and policy tuning Own the sender-authentication stack (SPF, DKIM, and DMARC) from monitoring through enforcement, and manage mail routing and inbound/outbound threat protection Investigate email-borne threats and phishing incidents with Information Security; tune policies to cut false positives without opening exposureCore: Networking & Security Apply working command of TCP/IP, DNS, routing, switching, firewalls, VPNs, VLANs, and NAT to keep messaging and identity reachable and secure Troubleshoot network-layer faults affecting mail flow, hybrid connectivity, and authentication end to end Apply network-security principles and integrate cleanly across messaging, identity, cloud, and the security stackCore: Microsoft 365, Identity & Automation Administer Microsoft 365, Entra ID (Azure AD), and Single Sign-On (SSO): tenant configuration, conditional access, and application registrations in coordination with Information Security Build and maintain PowerShell scripting and automation for provisioning, reporting, bulk operations, and repeatable runbooks Own monitoring, backup, disaster recovery, patching, and infrastructure documentation for the messaging and identity estate; keep runbooks and topology currentGeneral Provide senior-level escalation for messaging, identity, and email-security incidents raised by IT Team Leaders and the Service Desk Maintain up-to-date, formally registered technical documentation, standard operating procedures, and as-built diagrams Contribute to departmental KPI objectives set for the financial year Ensure IT policies, security standards, and change-management procedures are followed Perform other assignments as requiredBusiness Continuity Ensure the messaging and identity BC/DR plans adequately deliver the required recovery capability and meet business continuity requirements Maintain, test, and document DAG failover, AD recovery, and Exchange/M365 restore procedures on a periodic basis Communicate the implications of infrastructure changes that may impact the BCMS Participate in BC exercises; support the Business Impact Analysis for messaging and identity services Make recommendations, remove roadblocks, and report continuity risk to IT managementWorking Arrangement (Onshore, Riyadh) Base: Riyadh, with on-site and hybrid working arrangements in line with organisational policy Hours: Standard working hours, with flexibility to support business needs On-call: Participates in an on-call rotation for critical messaging, identity, and email-security incidents, including outside standard working hours, in line with agreed response targets Change windows: Executes major changes (upgrades, migrations, DAG/AD maintenance) inside approved maintenance windows, typically outside peak, with change-management sign-off Access & security: Follows applicable information security, data-handling, and privileged-access controlsCompetencies: Professional and TechnicalBehavioral CompetenciesCompetency LevelAnalytical Thinking Level 4Initiative Level 3Continuous Learning Level 3Communication (written & verbal) Level 3Stress Management Level 3Planning & Organizing Level 3Adaptability Level 3Teamwork Level 3Technical CompetenciesCompetency ProficiencyMicrosoft Exchange Server 2019 (on-prem + hybrid, DAG) ExpertExchange migrations & mail flow / connectors / certificates ExpertActive Directory & Group Policy (design, DR, replication) ExpertDNS / DHCP / domain services AdvancedEmail security (gateway, SPF/DKIM/DMARC, anti-phishing) AdvancedMicrosoft 365 / Entra ID / SSO / Conditional Access AdvancedPowerShell scripting & automation AdvancedNetworking & network security (TCP/IP, firewall, VPN, VLAN, NAT) Intermediate to AdvancedBackup, DR, patching & infrastructure documentation AdvancedCritical incident management AdvancedCompetencies: EHSAwareness of basic EHS requirements and corporate objectives; awareness of EHS/incident reporting within the QEHS management system.Organizational CompetenciesIntermediate. Refer to the organisation's applicable competency framework.Decision MakingDecides and executes: messaging/identity configuration, patch and change execution within approved windows, migration cutover mechanics, GPO and email-security policy tuning, and automation design. Recommends and routes up: architecture changes, tenant-level identity/security policy, BC/DR strategy, and major-version platform decisions (to the relevant IT infrastructure and Information Security leadership).Key Performance Indicators (KPIs) Maintain high availability of messaging services and prevent avoidable outages through timely certificate management and patching Respond to critical messaging and identity incidents within agreed targets, restore services promptly, and document root causes Mailbox migration waves delivered on schedule with zero data loss and a tested rollback per wave Keep systems patched in line with approved security baselines and remediate critical vulnerabilities within required timeframes Email security: SPF/DKIM/DMARC at enforcement; measured reduction in delivered phishing/spam with controlled false-positive rate Test business continuity and disaster recovery procedures periodically and document successful recovery tests Maintain current technical runbooks and infrastructure documentation for all owned services Meet the individual KPIs agreed for the current financial yearLevel 3 Engineer of Microsoft Exchange 2019 and Exchange Server Subscription Edition. Have proven experience in installation and upgrade of Microsoft Exchange Environment-ExpertHybrid environment Microsoft 365 ability to manage Microsoft Teams. Active Directory and understanding of Group PoliciesRequirementsQualification: Education and Experience Language: Arabic (native) and English (professional working proficiency) Education: Bachelor's degree in Computer Science, Information Technology, or a related field. Equivalent experience with strong certification is acceptable in lieu of the degree Experience: For a fully-fledged senior, 8+ years in enterprise Microsoft infrastructure, of which 5+ years hands-on with Exchange Server (2016/2019) on-premises and Exchange hybrid with Microsoft 365, in a mid-to-large, multi-site enterprise environment, with a full Exchange migration and a DAG deployment owned. A strong mid-senior Saudi national (6+ years) with solid Active Directory / Entra ID / Microsoft 365 depth and a genuine appetite to master on-prem Exchange is acceptable and encouraged under the organisation's development pathway, entering on a structured certification ramp (see the development plan) Certifications: Strongly preferred: MCSE: Messaging or MCSE: Server Infrastructure (or legacy MCITP: Enterprise Messaging), evidencing Exchange + AD depth. For a mid-senior entrant, these become ramp targets Preferred: Microsoft 365 Certified: Messaging Administrator Associate (MS-203); Enterprise Administrator Expert (MS-102); Identity and Access Administrator (SC-300); Windows Server Hybrid Administrator (AZ-800/AZ-801) Nice-to-have: email-security vendor certification (Proofpoint / Mimecast / Microsoft Defender for Office 365), a networking cert (CCNA-level), and a security baseline (SC-900 / Security+)