MSP System Engineer

ABOUT FUNCSHUN
FUNCSHUN is a Miami-based cybersecurity and IT services firm, founded in 2011. We started as an IT services provider and grew into a cybersecurity firm: security consulting, managed IT operations, incident response, and compliance (PCI DSS, FTC Safeguards, CMMC) for small and mid-sized businesses, many of them regulated — CPA firms, law firms, card merchants, condominium associations, contractors. We are a team of eight. Every ticket is worked with security in mind.

ABOUT THE ROLE
We're hiring a Systems Engineer to lead our help desk. This seat is the technical backbone of the service desk: you work the live ConnectWise board every day, you are the first escalation point for L1 work, you carry the daily operational controls (backup audits, patch review, alert triage), and you own client tickets from open to closure. You will be a trusted technical voice in front of customers, in English and in Spanish.
You'll work across a dozen-plus client environments, which means constant context switching between different networks, stacks, and people. If you need one quiet system to focus on, this is the wrong seat. If you like closing twelve to twenty tickets a day, fixing the thing that keeps coming back, and being the person the team relies on, keep reading.
This is not entry-level help desk. This is hands-on troubleshooting, system awareness, disciplined documentation, and ownership.

WHY THIS SEAT MATTERS
The engineer in this role typically handles a fifth of all ticket work at FUNCSHUN and the majority of the on-call rotation. It is the highest-volume, most client-facing technical seat in the company.

RESPONSIBILITIES
Own the live board
Work the Help Desk board daily: triage new tickets, set priority and type correctly, schedule work, and keep every ticket moving toward closure with same-day time entries and clear notes.
Resolve L1/L2 tickets across Microsoft 365 (Entra ID, Exchange Online, Intune, Conditional Access), Windows 10/11, Windows Server, printers and peripherals, line-of-business apps (Sage, Autodesk, QuickBooks, LEAP, Toast), and networking (WatchGuard, UniFi, Starlink).
Run the morning stand-up ticket review and the mid-day board check; flag SLA risk and blockers early.
Take your turn in the on-call rotation and respond to after-hours incidents per the on-call runbook.
Run the daily and weekly controls
Perform the Daily Server Backup Audit (Acronis) every business day and open remediation tickets for any failed or missing job.
Run the weekly patching review: confirm NinjaOne patch compliance for client workstations and servers, schedule maintenance windows, and follow up on machines that fall out of policy.
Triage RMM alerts (offline servers, CPU/disk thresholds, service failures) and Managed SOC / MDR alerts; take first-response actions and escalate to the CTO with evidence.
Deliver security work on client tenants
Execute standardized security rollouts: MFA enrollment and migrations (Duo, Entra External MFA), Conditional Access policy reviews, BitLocker enablement, Keeper password manager onboarding, ThreatLocker allowlisting, Defender and RocketCyber configuration.
Perform user onboarding/offboarding, device provisioning, and access reviews, following FUNCSHUN checklists and leaving an evidence trail in the ticket.
Lead small client projects: workstation and server refreshes, network segmentation, domain and DNS moves, application deployments — scoped, scheduled, and closed in ConnectWise.
Improve the system
Identify root causes on repeat issues and recommend fixes or escalations with evidence, not band-aids.
Maintain accurate documentation in IT Glue / SharePoint; follow and improve SOPs; flag gaps.
Coach junior technicians and hand back work that belongs at L1 with clear instructions.
HOW WE WORK
AI is part of your toolkit. We use Claude, Copilot, and similar tools daily to draft runbooks, write PowerShell, interpret logs, and speed up research. We expect you to do the same and to show us how. We also expect you to know what never goes into a public model: client names, credentials, PII, or anything covered by our AI Use Policy.
Everything happens in the ticket. If it isn't in ConnectWise, it didn't happen. Time entries are logged in real time, in 10-minute increments during troubleshooting, with screenshots where applicable.Security is not a department. You'll be asked "why is this the secure way?" on ordinary tickets.

SUCCESS MILESTONES
Milestone What "done" looks like
By Day 30 Working the board independently within SLA with complete notes and same-day time entries; running the Daily Server Backup Audit and weekly patch review without prompting; first on-call shift completed.
By Day 60 Escalations to the CTO arrive with evidence and a proposed fix; at least two repeat-issue root causes identified and eliminated; first SOP rewritten; first client security rollout (MFA, BitLocker, or Keeper) delivered end to end.
By Day 90 Handling priority incidents independently; first small client project delivered; ticket backlog for your queue trending down; clients recognize you by name.
Milestones are reviewed at each checkpoint; the Day 30 checkpoint doubles as the end of the paid trial period.

MUST-HAVE STACK
ConnectWise Manage (PSA) and an RMM — NinjaOne preferred; Automate, Datto or Kaseya acceptable
Microsoft 365 administration: Entra ID, Exchange Online, Intune, Conditional Access, SharePoint/OneDrive
Windows 10/11 and Windows Server troubleshooting (AD, GPO, DNS/DHCP, file services, Hyper-V basics)
PowerShell scripting for repeatable admin tasks
Backup platforms (Acronis a strong plus) — job monitoring, restores, and audit reporting
Security tooling: EDR/MDR, MFA rollouts (Duo / Entra), application allowlisting (ThreatLocker a strong plus), password managers (Keeper), phishing response
Firewalls and networking fundamentals — WatchGuard or UniFi a plus
Microsoft Teams and SharePoint / IT Glue-based documentation

QUALIFICATIONS
4+ years at an IT or security services provider supporting multiple clients simultaneously (not a single internal IT department)
Strong troubleshooting skills and a root-cause mindset
Security-aware by default
Fluent in English and Spanish, written and spoken
Clear, concise documentation and client communication
Accountability mindset; comfortable with high ticket volume and frequent context switching
Nice to have: MS-102, AZ-104, SC-200, Security+ / CySA+; exposure to PCI DSS, FTC Safeguards, or CMMC evidence collection; incident response experience; experience with condominium associations, law firms, or construction trades clients
TERMS
Full-time independent contractor, 40 hrs/week, long term, US Eastern business hours (9–6 ET) with occasional after-hours maintenance windows and a shared on-call rotation
Rate depending on depth of experience
All work performed on a FUNCSHUN-provided virtual desktop with MFA
Background and reference checks required before access to client environments
Paid 30-day trial against the Day 30 milestones above, then ongoing

HOW TO APPLY
Candidates who make it to the technical interview will be asked to work a sample ticket live.

Location: Remote - GMT-08:00 to GMT-02:00

Skills required for this job:

• Active Directory (AD)
• Artificial intelligence (AI)
• Automation
• Conditional Access
• Firewall
• IT Glue
• Intune
• Microsoft 365
• Microsoft Azure
• Network infrastructure
• PowerShell
• System hardening
• Windows Server