System Engineer

About the role

We are looking for a System Engineer to join our IT team and act as deputy for our infrastructure lead. You will share responsibility for our own datacenter, disaster‑recovery site and the IT services we provide to Forfirm and several client companies.

Key responsibilities

• Operate and develop our virtualization and storage platform (Proxmox VE with Ceph, TrueNAS/ZFS).
• Administer Windows Server, Active Directory, DNS/DHCP and Microsoft 365/Entra ID (Conditional Access, MFA, Exchange Online).
• Manage endpoints with Microsoft Intune for Windows, macOS, iOS and Android, including compliance policies and Apple Business Manager.
• Run backup, replication and restore procedures and support the DR site.
• Support security operations: SIEM (Wazuh, Microsoft Sentinel), endpoint protection (ESET), vulnerability scans (Nessus) and CIS‑based hardening.
• Maintain network and perimeter components (FortiGate, pfSense, Sophos, UniFi, VPN).
• Monitor systems with Zabbix, handle alerts and incidents, and perform root‑cause analysis.
• Automate tasks with Ansible, PowerShell, Bash or Python.
• Operate containerised services (Docker, Traefik) with configurations versioned in GitHub Enterprise.
• Provide 2nd and 3rd‑level support and document systems and procedures.

Required profile

• IT education (EFZ, HF/FH) or equivalent practical experience.
• At least 4 years of experience as a System Engineer or System Administrator.
• Solid knowledge of Windows Server, Active Directory and Microsoft 365/Entra ID.
• Hands‑on experience with Intune; macOS/iOS management is a plus.
• Experience with virtualization (Proxmox or VMware) and Linux servers (Debian/Ubuntu).
• Good understanding of networking, firewalls and VPN.
• Scripting skills in PowerShell and/or Bash/Python.
• Interest in IT security; CIS benchmarks or regulated‑environment experience is an asset.
• Very good Italian and good English; German is a plus.

Required skills

• Proxmox VE, Ceph, TrueNAS/ZFS
• Windows Server, Active Directory, DNS, DHCP
• Microsoft 365, Entra ID, Conditional Access, MFA, Exchange Online
• Intune, macOS, iOS, Android, Apple Business Manager
• Wazuh, Microsoft Sentinel, ESET, Nessus, CIS hardening
• FortiGate, pfSense, Sophos, UniFi, VPN
• Zabbix
• Ansible, PowerShell, Bash, Python
• Docker, Traefik, GitHub Enterprise

What we offer

• Broad responsibility across datacenter, cloud, endpoints and security.
• A modern, largely automated infrastructure you will help shape.
• Variety of internal IT work and projects for different client companies.
• Small team with short decision paths and direct contact with management.
• Workplace in Lugano.