Senior Microsoft Infrastructure & Exchange Engineer

About the Role
This position is pivotal in ensuring the health, security, and continuity of the organisation's core Microsoft platform. You will manage Exchange Server 2019 (on-premises) in a hybrid environment with Microsoft 365, alongside Active Directory, Group Policy, DNS/DHCP, and the identity and email-security layers that support them. The role focuses on maintaining reliable corporate messaging, mailbox availability, and identity services across multiple sites in a business environment.

Key Responsibilities
Core: Microsoft Exchange (on-premises + hybrid)

• Install, configure, administer, and upgrade Microsoft Exchange Server 2019 on-premises; apply cumulative updates and security patches on a controlled schedule.
• Maintain Exchange Hybrid with Microsoft 365: configuration, free/busy, cross-premises mail flow, and directory synchronization health.
• Execute mailbox migrations (on-prem to/from Exchange Online) with zero-data-loss cutovers and a tested rollback for each wave.
• Manage mailbox lifecycle, distribution and shared mailboxes, mail flow, transport rules, send/receive connectors, and certificate lifecycle (issuance, renewal, binding) with no lapsed-certificate outages.
• Design, build, and maintain Database Availability Groups (DAG) for Exchange high availability; oversee failover testing and quorum health.
• Diagnose and resolve complex mail-delivery, queue, performance, and availability problems using message tracking, protocol logs, and transport diagnostics.

Core: Active Directory & Group Policy

• Perform advanced Active Directory administration: domain services, sites, trusts, OU design, delegation, user authentication, and permissions.
• Design, implement, troubleshoot, and optimize Group Policy (GPO): scope, precedence, security filtering, and drift control.
• Administer and maintain DNS and DHCP as authoritative infrastructure services for the estate.
• Own AD replication health, security hardening (privileged accounts, tiering), and disaster-recovery readiness for the directory (backup, forest/domain recovery runbook, tested restore).

Core: Email Security

• Administer the enterprise email-security gateway/solution: anti-spam, anti-phishing, malware protection, content filtering, quarantine management, and policy tuning.
• Manage the sender-authentication stack (SPF, DKIM, and DMARC) from monitoring through enforcement, and manage mail routing and inbound/outbound threat protection.
• Investigate email-borne threats and phishing incidents with Information Security; tune policies to minimize false positives without increasing exposure.

Core: Networking & Security

• Apply working command of TCP/IP, DNS, routing, switching, firewalls, VPNs, VLANs, and NAT to maintain messaging and identity security and accessibility.
• Troubleshoot network-layer faults affecting mail flow, hybrid connectivity, and authentication end to end.
• Apply network-security principles and integrate messaging, identity, cloud, and the overall security stack.

Core: Microsoft 365, Identity & Automation

• Administer Microsoft 365, Entra ID (Azure AD), and Single Sign-On (SSO): tenant configuration, conditional access, and application registrations in coordination with Information Security.
• Build and maintain PowerShell scripting and automation for provisioning, reporting, bulk operations, and repeatable runbooks.
• Own monitoring, backup, disaster recovery, patching, and infrastructure documentation for the messaging and identity estate; keep runbooks and topology current.

General

• Provide senior-level escalation for messaging, identity, and email-security incidents raised by IT Team Leaders and the Service Desk.
• Maintain up-to-date, formally registered technical documentation, standard operating procedures, and as-built diagrams.
• Contribute to departmental KPI objectives set for the financial year.
• Ensure IT policies, security standards, and change-management procedures are followed.
• Perform other assignments as required.

Business Continuity

• Ensure messaging and identity BC/DR plans deliver the required recovery capability and meet business continuity requirements.
• Maintain, test, and document DAG failover, AD recovery, and Exchange/M365 restore procedures periodically.
• Communicate implications of infrastructure changes that may impact the BCMS.
• Participate in BC exercises; support the Business Impact Analysis for messaging and identity services.
• Make recommendations, remove roadblocks, and report continuity risk to IT management.

Working Arrangement

• Base: Riyadh, with on-site and hybrid working arrangements as per organisational policy.
• Hours: Standard working hours with flexibility to support business needs.
• On-call: Participates in an on-call rotation for critical messaging, identity, and email-security incidents outside standard hours, in line with response targets.
• Change windows: Executes major changes inside approved maintenance windows, typically outside peak hours, with change-management sign-off.
• Access & security: Adheres to applicable information security, data-handling, and privileged-access controls.

Competencies
Professional and Technical
Behavioral Competencies

• Analytical Thinking: Level 4
• Initiative: Level 3
• Continuous Learning: Level 3
• Communication (written & verbal): Level 3
• Stress Management: Level 3
• Planning & Organizing: Level 3
• Adaptability: Level 3
• Teamwork: Level 3

Technical Competencies

• Microsoft Exchange Server 2019 (on-prem + hybrid, DAG): Expert
• Exchange migrations & mail flow / connectors / certificates: Expert
• Active Directory & Group Policy (design, DR, replication): Expert
• DNS / DHCP / domain services: Advanced
• Email security (gateway, SPF/DKIM/DMARC, anti-phishing): Advanced
• Microsoft 365 / Entra ID / SSO / Conditional Access: Advanced
• PowerShell scripting & automation: Advanced
• Networking & network security (TCP/IP, firewall, VPN, VLAN, NAT): Intermediate to Advanced
• Backup, DR, patching & infrastructure documentation: Advanced
• Critical incident management: Advanced

Competencies: EHS

• Awareness of basic EHS requirements and corporate objectives; awareness of EHS/incident reporting within the QEHS management system.

Decision Making
Makes decisions regarding messaging/identity configuration, patch and change execution within approved windows, migration cutover mechanics, GPO and email-security policy tuning, and automation design. Recommends architectural changes, tenant-level identity/security policy, BC/DR strategy, and major-version platform decisions to relevant IT infrastructure and Information Security leadership.

Key Performance Indicators (KPIs)

• Maintain high availability of messaging services and prevent avoidable outages through timely certificate management and patching.
• Respond to critical messaging and identity incidents within agreed targets, restore services promptly, and document root causes.
• Deliver mailbox migration waves on schedule with zero data loss and a tested rollback per wave.
• Ensure systems are patched according to approved security baselines and remediate critical vulnerabilities within required timeframes.
• Achieve SPF/DKIM/DMARC enforcement; measure reduction in delivered phishing/spam with controlled false-positive rates.
• Periodically test business continuity and disaster recovery procedures and document successful recovery tests.
• Maintain current technical runbooks and infrastructure documentation for all managed services.
• Meet individual KPIs agreed upon for the current financial year.

Qualifications: Education and Experience

• Language: Arabic (native) and English (professional working proficiency).
• Education: Bachelor's degree in Computer Science, Information Technology, or a related field. Equivalent experience with strong certification is acceptable in lieu of the degree.
• Experience: 8+ years in enterprise Microsoft infrastructure, including 5+ years hands-on with Exchange Server (2016/2019) on-premises and Exchange hybrid with Microsoft 365 in a multi-site environment. A strong mid-senior Saudi national with solid Active Directory / Entra ID / Microsoft 365 depth and a genuine appetite to master on-prem Exchange may qualify under the organisation's development pathway, entering on a structured certification ramp.
• Certifications:
  • Strongly preferred: MCSE: Messaging or MCSE: Server Infrastructure (or legacy MCITP: Enterprise Messaging), demonstrating Exchange + AD depth. For mid-senior entrants, these become ramp targets.
  • Preferred: Microsoft 365 Certified: Messaging Administrator Associate (MS-203); Enterprise Administrator Expert (MS-102); Identity and Access Administrator (SC-300); Windows Server Hybrid Administrator (AZ-800/AZ-801).
  • Nice-to-have: email-security vendor certification (Proofpoint / Mimecast / Microsoft Defender for Office 365), networking cert (CCNA-level), and a security baseline (SC-900 / Security+).