IT Infrastructure & Cloud Engineer

Position: IT Infrastructure & Cloud Engineer Position Type: Full-time, permanent Department: Information Technology Location: Boulder, Colorado (onsite) Experience: Bachelors in Information Technology, Computer Science, or related field required + 8-12 years relevant experience Position Summary Watchmaker Genomics is inviting applications for the full-time position of IT Infrastructure & Cloud Engineer, an onsite role in our Boulder, Colorado office. This position reports to the Director IT, Boulder site for day-to-day execution and service delivery, and is responsible for hands-on execution and maintenance of Watchmaker's network and Azure cloud infrastructure at the Boulder site. This role works in close partnership with our Infrastructure & Cloud Lead based in Cape Town, South Africa, who sets global architecture standards and technical direction for the network and cloud environment. The Boulder-based Engineer is the primary hands-on resource for network engineering and Azure administration in the US, translating that global direction into local implementation and feeding site-level needs and constraints back into global design decisions. Windows and macOS endpoint management is owned day-to-day by our End User Compute Engineer; this role partners with that engineer on compliance standards and infrastructure-level policy, but is not expected to carry endpoint administration as a primary workload. The successful candidate will thrive in a dynamic, fast-paced environment and contribute directly to our company culture and success. This position offers hands-on responsibility for Watchmaker's Boulder-site network and cloud infrastructure, close collaboration with a global IT team spanning the US and South Africa, and the opportunity to mentor service desk staff on complex infrastructure and network escalations as the team grows. Core Responsibilities: Azure Cloud & Identity Infrastructure: Build, administer, and maintain Watchmaker's Azure cloud infrastructure and services, and administer identity, authentication, and access management in Microsoft Entra — including conditional access, multi-factor authentication, and joiner/mover/leaver processes — in line with global architecture and security standards. [Critical requirement] Network Infrastructure: Design, configure, maintain, and troubleshoot the site's network infrastructure, including switching, wireless, firewalls, VPNs, and load balancing. Advanced, hands-on network engineering is the other core pillar of this role. [Critical requirement] System Design and Architecture: Implement complex IT infrastructure — servers, storage, networks, and cloud services — in line with Watchmaker's global architecture standards. Security and Cyber Security Protection: Operate security systems across endpoints and cloud workloads; monitor, triage, and respond to security alerts; execute patch and vulnerability management using Microsoft Defender. Endpoint Management (collaborative): Partner with the End User Compute Engineer on Windows and macOS endpoint compliance, configuration baselines, and application deployment standards. Day-to-day enrollment and device support is owned by the EUC Engineer, not this role. System Administration and Maintenance: Execute or oversee the installation, configuration, and maintenance of servers, virtual environments, and enterprise applications, including Active Directory, DNS, DHCP, and other core services. Performance Monitoring and Optimization: Monitor server, network, storage, and cloud performance; troubleshoot issues and optimize infrastructure for stability, security, and efficiency. Automation and Scripting: Develop and use automation tools and scripts (e.g., PowerShell, Python, Bash) to streamline operations and system management. Computer Systems Validation: Perform required Computer Systems Validation actions to support ISO 13485. Documentation and Operational Discipline: Maintain accurate infrastructure documentation, work instructions, and knowledge base articles; execute all changes through formal change management; track and coordinate purchasing for infrastructure and network hardware. Risk Management and Escalation: Proactively identify, communicate, and escalate risks, incidents, and capacity constraints to the Director IT, Boulder site in a timely manner. Technical Guidance and Teamwork: Provide technical guidance to service desk staff on complex network and infrastructure escalations, and collaborate with cross-functional and global teams to meet business objectives. Business Continuity, Disaster Recovery & Incident Response: Design and implement disaster recovery (DR) plans, ensuring critical systems and data can be restored in case of failure or outage, and conduct regular DR testing to validate recovery against defined RTOs and RPOs. Oversee regular backups of data, systems, and configurations; ensure backups are complete, secure, and recoverable, and that restores are verified through scheduled test recoveries. Implement and maintain redundancy for key systems (servers, storage, network components) to minimize downtime and ensure business continuity during failures. Lead response efforts during major outages or incidents, including root cause analysis for recurring problems, coordinating recovery activities, and communicating status updates to stakeholders. Monitor resource usage and cloud spend (capacity planning and regular cloud cost reviews) to forecast future needs and ensure scalability and cost efficiency. Maintain and regularly update documentation of continuity and recovery procedures to reflect business changes and new technologies. Skills and Requirements Advanced network engineering: hands-on experience configuring and troubleshooting routing, switching, wireless, firewalls, VPNs, and load balancing in an enterprise environment; strong knowledge of network protocols and network security best practices. [Critical requirement] Microsoft Azure & Entra: proven, hands-on experience building, administering, and maintaining Azure infrastructure and cloud services, and administering Microsoft Entra identity and access management (conditional access, MFA, joiner/mover/leaver). [Critical requirement] Microsoft Defender: experience with security operations and cyber security protection across endpoints and cloud workloads, including patch and vulnerability management. Windows Server administration: proficiency managing and administering Windows servers, including Active Directory, DNS, DHCP, and other core services. Automation and scripting: experience with automation tools and scripting languages (e.g., PowerShell, Python, Bash) for automating system administration tasks and managing large-scale environments. Disaster recovery: practical experience designing and executing DR plans, including management and verification of backup systems and business continuity. Project experience: experience leading or participating in IT projects — system upgrades, migrations, and deployments — with the ability to coordinate across teams. Operational discipline: a disciplined, documentation-first approach to operations with a proactive risk mindset — anticipating issues, communicating early, and escalating appropriately. Collaboration: strong interpersonal skills and the ability to work as an effective member of a distributed, global team. Preferred Additional Experience: Experience with Microsoft Intune and/or JAMF for endpoint management is a plus, but is not required — day-to-day endpoint administration is owned by our End User Compute Engineer. Experience in multi-national or corporate environments are essential; Experience with the ITIL framework and other IT Service management tools; Familiarity with industry standards and regulations such as ISO, NIST, POPIA, GDPR, or HIPAA, and experience implementing security policies to meet compliance requirements; Computer Systems Validation (CSV) experience in manufacturing environments Compensation The base compensation for the IT Infrastructure & Cloud Engineer role starts at $100,000- $130,000 + bonus + equity; actual pay will be adjusted based on skills and experience. Employees are eligible for Flexible Time Off, Holidays, employer covers 75% of base medical plan with buy-up options, EAP (employee assistance program), employer paid dental with a buy-up option, employer paid vision, employer paid $25,000 life/AD&D policy, paid parental leave, and a 401(k) retirement plan with a 4% match. Application Requirements To apply for the position, please submit the following in a PDF format on watchmakergenomics.com: Letter of motivation (upload where it says cover letter) Resume or Curriculum vitae, highlighting relevant qualifications and experience Applications without a Letter of Motivation will not be considered. Local candidates preferred. Applications will be accepted on a rolling basis and the position will remain open until filled; however, early submission is encouraged as review will begin immediately. If selected to participate in the interview process, the names and contact information of three professional references who are able to assess your suitability for the position in terms of the specified requirements will be requested. *** NO RECRUITMENT AGENCIES PLEASE We are only accepting direct applications for this position. We are not working with external recruiters or agencies at this time. Unsolicited resumes or candidate submissions from third-party recruiters will not be considered and will be deemed the property of Watchmaker Genomics. *** WE ARE AN EQUAL OPPORTUNITY/AFFIRMATIVE ACTION EMPLOYER Watchmaker Genomics is committed to being an equal opportunity employer and creating a culturally diverse environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability status, age, or veteran status or any other characteristics as protected by applicable law. All applicants will be asked if currently eligible to work in the United States of America; and if now or in the future will require visa sponsorship to continue working in the United States. This position may be subject to pre-employment checks, including driving history check, drug screening and a background check for any convictions directly related to its duties and responsibilities. All pre-employment checks will comply with all applicable federal, state, and local laws.