Senior Microsoft Infrastructure & Exchange Engineer

Own the health, security, and continuity of the organisation's core Microsoft platform: Exchange Server 2019 (on-premises) in hybrid with Microsoft 365, Active Directory, Group Policy, DNS/DHCP, and the identity and email-security layers that sit on top of them. The role helps maintain reliable corporate messaging, mailbox availability, and identity services in a multi-site business environment. KEY Responsibilities Core: Microsoft Exchange (on-premises + hybrid) • Install, configure, administer, and upgrade Microsoft Exchange Server 2019 on-premises; apply cumulative updates and security patches on a controlled schedule • Run and maintain Exchange Hybrid with Microsoft 365: hybrid configuration, free/busy, cross-premises mail flow, and directory synchronisation health • Execute mailbox migrations (on-prem to/from Exchange Online) with zero-data-loss cutovers and a tested rollback for each wave • Manage mailbox lifecycle, distribution and shared mailboxes, mail flow, transport rules, send/receive connectors, and certificate lifecycle (issuance, renewal, binding) with no lapsed-certificate outages • Design, build, and maintain Database Availability Groups (DAG) for Exchange high availability; own failover testing and quorum health • Diagnose and resolve complex mail-delivery, queue, performance, and availability problems using message tracking, protocol logs, and transport diagnostics Core: Active Directory & Group Policy • Perform advanced Active Directory administration: domain services, sites, trusts, OU design, delegation, user authentication, and permissions • Design, implement, troubleshoot, and optimise Group Policy (GPO): scope, precedence, security filtering, and drift control • Administer and maintain DNS and DHCP as authoritative infrastructure services for the estate • Own AD replication health, security hardening (privileged accounts, tiering), and disaster-recovery readiness for the directory (backup, forest/domain recovery runbook, tested restore) Core: Email Security • Administer the enterprise email-security gateway/solution: anti-spam, anti-phishing, malware protection, content filtering, quarantine management, and policy tuning • Own the sender-authentication stack (SPF, DKIM, and DMARC) from monitoring through enforcement, and manage mail routing and inbound/outbound threat protection • Investigate email-borne threats and phishing incidents with Information Security; tune policies to cut false positives without opening exposure Core: Networking & Security • Apply working command of TCP/IP, DNS, routing, switching, firewalls, VPNs, VLANs, and NAT to keep messaging and identity reachable and secure • Troubleshoot network-layer faults affecting mail flow, hybrid connectivity, and authentication end to end • Apply network-security principles and integrate cleanly across messaging, identity, cloud, and the security stack Core: Microsoft 365, Identity & Automation • Administer Microsoft 365, Entra ID (Azure AD), and Single Sign-On (SSO): tenant configuration, conditional access, and application registrations in coordination with Information Security • Build and maintain PowerShell scripting and automation for provisioning, reporting, bulk operations, and repeatable runbooks • Own monitoring, backup, disaster recovery, patching, and infrastructure documentation for the messaging and identity estate; keep runbooks and topology current General • Provide senior-level escalation for messaging, identity, and email-security incidents raised by IT Team Leaders and the Service Desk • Maintain up-to-date, formally registered technical documentation, standard operating procedures, and as-built diagrams • Contribute to departmental KPI objectives set for the financial year • Ensure IT policies, security standards, and change-management procedures are followed • Perform other assignments as required Business Continuity • Ensure the messaging and identity BC/DR plans adequately deliver the required recovery capability and meet business continuity requirements • Maintain, test, and document DAG failover, AD recovery, and Exchange/M365 restore procedures on a periodic basis • Communicate the implications of infrastructure changes that may impact the BCMS • Participate in BC exercises; support the Business Impact Analysis for messaging and identity services • Make recommendations, remove roadblocks, and report continuity risk to IT management Working Arrangement (Onshore, Riyadh) • Base: Riyadh, with on-site and hybrid working arrangements in line with organisational policy • Hours: Standard working hours, with flexibility to support business needs • On-call: Participates in an on-call rotation for critical messaging, identity, and email-security incidents, including outside standard working hours, in line with agreed response targets • Change windows: Executes major changes (upgrades, migrations, DAG/AD maintenance) inside approved maintenance windows, typically outside peak, with change-management sign-off • Access & security: Follows applicable information security, data-handling, and privileged-access controls Competencies: Professional and Technical Behavioral Competencies Competency Level Analytical Thinking Level 4 Initiative Level 3 Continuous Learning Level 3 Communication (written & verbal) Level 3 Stress Management Level 3 Planning & Organizing Level 3 Adaptability Level 3 Teamwork Level 3 Technical Competencies Competency Proficiency Microsoft Exchange Server 2019 (on-prem + hybrid, DAG) Expert Exchange migrations & mail flow / connectors / certificates Expert Active Directory & Group Policy (design, DR, replication) Expert DNS / DHCP / domain services Advanced Email security (gateway, SPF/DKIM/DMARC, anti-phishing) Advanced Microsoft 365 / Entra ID / SSO / Conditional Access Advanced PowerShell scripting & automation Advanced Networking & network security (TCP/IP, firewall, VPN, VLAN, NAT) Intermediate to Advanced Backup, DR, patching & infrastructure documentation Advanced Critical incident management Advanced Competencies: EHS Awareness of basic EHS requirements and corporate objectives; awareness of EHS/incident reporting within the QEHS management system. Organizational Competencies Intermediate. Refer to the organisation's applicable competency framework. Decision Making Decides and executes: messaging/identity configuration, patch and change execution within approved windows, migration cutover mechanics, GPO and email-security policy tuning, and automation design. Recommends and routes up: architecture changes, tenant-level identity/security policy, BC/DR strategy, and major-version platform decisions (to the relevant IT infrastructure and Information Security leadership). Key Performance Indicators (KPIs) • Maintain high availability of messaging services and prevent avoidable outages through timely certificate management and patching • Respond to critical messaging and identity incidents within agreed targets, restore services promptly, and document root causes • Mailbox migration waves delivered on schedule with zero data loss and a tested rollback per wave • Keep systems patched in line with approved security baselines and remediate critical vulnerabilities within required timeframes • Email security: SPF/DKIM/DMARC at enforcement; measured reduction in delivered phishing/spam with controlled false-positive rate • Test business continuity and disaster recovery procedures periodically and document successful recovery tests • Maintain current technical runbooks and infrastructure documentation for all owned services • Meet the individual KPIs agreed for the current financial year • Level 3 Engineer of Microsoft Exchange 2019 and Exchange Server Subscription Edition. Have proven experience in installation and upgrade of Microsoft Exchange Environment-Expert • Hybrid environment Microsoft 365 ability to manage Microsoft Teams. Active Directory and understanding of Group Policies Requirements Qualification: Education and Experience • Language: Arabic (native) and English (professional working proficiency) • Education: Bachelor's degree in Computer Science, Information Technology, or a related field. Equivalent experience with strong certification is acceptable in lieu of the degree • Experience: For a fully-fledged senior, 8+ years in enterprise Microsoft infrastructure, of which 5+ years hands-on with Exchange Server (2016/2019) on-premises and Exchange hybrid with Microsoft 365, in a mid-to-large, multi-site enterprise environment, with a full Exchange migration and a DAG deployment owned. A strong mid-senior Saudi national (6+ years) with solid Active Directory / Entra ID / Microsoft 365 depth and a genuine appetite to master on-prem Exchange is acceptable and encouraged under the organisation's development pathway, entering on a structured certification ramp (see the development plan) • Certifications: • Strongly preferred: MCSE: Messaging or MCSE: Server Infrastructure (or legacy MCITP: Enterprise Messaging), evidencing Exchange + AD depth. For a mid-senior entrant, these become ramp targets • Preferred: Microsoft 365 Certified: Messaging Administrator Associate (MS-203); Enterprise Administrator Expert (MS-102); Identity and Access Administrator (SC-300); Windows Server Hybrid Administrator (AZ-800/AZ-801) • Nice-to-have: email-security vendor certification (Proofpoint / Mimecast / Microsoft Defender for Office 365), a networking cert (CCNA-level), and a security baseline (SC-900 / Security+)