مهندس أول بنية تحتية وMicrosoft Exchange

Own the health, security, and continuity of the organisation's core Microsoft platform: Exchange Server 2019 (on-premises) in hybrid with Microsoft 365, Active Directory, Group Policy, DNS/DHCP, and the identity and email-security layers that sit on top of them. The role helps maintain reliable corporate messaging, mailbox availability, and identity services in a multi-site business environment.

KEY Responsibilities

Core: Microsoft Exchange (on-premises + hybrid)

Install, configure, administer, and upgrade Microsoft Exchange Server 2019 on-premises; apply cumulative updates and security patches on a controlled schedule.

Run and maintain Exchange Hybrid with Microsoft 365: hybrid configuration, free/busy, cross-premises mail flow, and directory synchronisation health.

Execute mailbox migrations (on-prem to/from Exchange Online) with zero-data-loss cutovers and a tested rollback for each wave.

Manage mailbox lifecycle, distribution and shared mailboxes, mail flow, transport rules, send/receive connectors, and certificate lifecycle (issuance, renewal, binding) with no lapsed-certificate outages.

Design, build, and maintain Database Availability Groups (DAG) for Exchange high availability; own failover testing and quorum health.

Diagnose and resolve complex mail-delivery, queue, performance, and availability problems using message tracking, protocol logs, and transport diagnostics.

Core: Active Directory & Group Policy

Perform advanced Active Directory administration: domain services, sites, trusts, OU design, delegation, user authentication, and permissions.

Design, implement, troubleshoot, and optimise Group Policy (GPO): scope, precedence, security filtering, and drift control.

Administer and maintain DNS and DHCP as authoritative infrastructure services for the estate.

Own AD replication health, security hardening (privileged accounts, tiering), and disaster-recovery readiness for the directory (backup, forest/domain recovery runbook, tested restore).

Core: Email Security

Administer the enterprise email-security gateway/solution: anti-spam, anti-phishing, malware protection, content filtering, quarantine management, and policy tuning.

Own the sender-authentication stack (SPF, DKIM, and DMARC) from monitoring through enforcement, and manage mail routing and inbound/outbound threat protection.

Investigate email-borne threats and phishing incidents with Information Security; tune policies to cut false positives without opening exposure.

Core: Networking & Security

Apply working command of TCP/IP, DNS, routing, switching, firewalls, VPNs, VLANs, and NAT to keep messaging and identity reachable and secure.

Troubleshoot network-layer faults affecting mail flow, hybrid connectivity, and authentication end to end.

Apply network-security principles and integrate cleanly across messaging, identity, cloud, and the security stack.

Core: Microsoft 365, Identity & Automation

Administer Microsoft 365, Entra ID (Azure AD), and Single Sign-On (SSO): tenant configuration, conditional access, and application registrations in coordination with Information Security.

Build and maintain PowerShell scripting and automation for provisioning, reporting, bulk operations, and repeatable runbooks.

Own monitoring, backup, disaster recovery, patching, and infrastructure documentation for the messaging and identity estate; keep runbooks and topology current.

General

Provide senior-level escalation for messaging, identity, and email-security incidents raised by IT Team Leaders and the Service Desk.

Maintain up-to-date, formally registered technical documentation, standard operating procedures, and as-built diagrams.

Contribute to departmental KPI objectives set for the financial year.

Ensure IT policies, security standards, and change-management procedures are followed.

Perform other assignments as required.

Business Continuity

Ensure the messaging and identity BC/DR plans adequately deliver the required recovery capability and meet business continuity requirements.

Maintain, test, and document DAG failover, AD recovery, and Exchange/M365 restore procedures on a periodic basis.

Communicate the implications of infrastructure changes that may impact the BCMS.

Participate in BC exercises; support the Business Impact Analysis for messaging and identity services.

Make recommendations, remove roadblocks, and report continuity risk to IT management.

Working Arrangement (Onshore, Riyadh)

Base: Riyadh, with on-site and hybrid working arrangements in line with organisational policy.

Hours: Standard working hours, with flexibility to support business needs.

On-call: Participates in an on-call rotation for critical messaging, identity, and email-security incidents, including outside standard working hours, in line with agreed response targets.

Change windows: Executes major changes (upgrades, migrations, DAG/AD maintenance) inside approved maintenance windows, typically outside peak, with change-management sign-off.

Access & security: Follows applicable information security, data-handling, and privileged-access controls.

Competencies: Professional and Technical

Behavioral Competencies

Competency Level

Analytical Thinking Level 4

Initiative Level 3

Continuous Learning Level 3

Communication (written & verbal) Level 3

Stress Management Level 3

Planning & Organizing Level 3

Adaptability Level 3

Teamwork Level 3

Technical Competencies

Competency Proficiency

Microsoft Exchange Server 2019 (on-prem + hybrid, DAG) Expert

Exchange migrations & mail flow / connectors / certificates Expert

Active Directory & Group Policy (design, DR, replication) Expert

DNS / DHCP / domain services Advanced

Email security (gateway, SPF/DKIM/DMARC, anti-phishing) Advanced

Microsoft 365 / Entra ID / SSO / Conditional Access Advanced

PowerShell scripting & automation Advanced

Networking & network security (TCP/IP, firewall, VPN, VLAN, NAT) Intermediate to Advanced

Backup, DR, patching & infrastructure documentation Advanced

Critical incident management Advanced

Competencies: EHS

Awareness of basic EHS requirements and corporate objectives; awareness of EHS/incident reporting within the QEHS management system.

Organizational Competencies

Intermediate. Refer to the organisation's applicable competency framework.

Desired Candidate Profile

Language: Arabic (native) and English (professional working proficiency).

Education: Bachelor's degree in Computer Science, Information Technology, or a related field. Equivalent experience with strong certification is acceptable in lieu of the degree.

Experience: For a fully-fledged senior, 8+ years in enterprise Microsoft infrastructure, of which 5+ years hands-on with Exchange Server (2016/2019) on-premises and Exchange hybrid with Microsoft 365, in a mid-to-large, multi-site enterprise environment, with a full Exchange migration and a DAG deployment owned. A strong mid-senior Saudi national (6+ years) with solid Active Directory / Entra ID / Microsoft 365 depth and a genuine appetite to master on-prem Exchange is acceptable and encouraged under the organisation's development pathway, entering on a structured certification ramp (see the development plan).

Certifications:

Strongly preferred: MCSE: Messaging or MCSE: Server Infrastructure (or legacy MCITP: Enterprise Messaging), evidencing Exchange + AD depth. For a mid-senior entrant, these become ramp targets.

Preferred: Microsoft 365 Certified: Messaging Administrator Associate (MS-203); Enterprise Administrator Expert (MS-102); Identity and Access Administrator (SC-300); Windows Server Hybrid Administrator (AZ-800/AZ-801).

Nice-to-have: email-security vendor certification (Proofpoint / Mimecast / Microsoft Defender for Office 365), a networking cert (CCNA-level), and a security baseline (SC-900 / Security+).