Systems Engineer, Help Desk Lead

FUNCSHUN is a Miami-based cybersecurity and IT services firm, founded in 2011. We started as an IT services provider and grew into a cybersecurity firm: security consulting, managed IT operations, incident response, and compliance (PCI DSS, FTC Safeguards, CMMC) for small and mid-sized businesses, many of them regulated — CPA firms, law firms, card merchants, condominium associations, contractors. We are a team of eight. Every ticket is worked with security in mind.

About the role

We're hiring a Systems Engineer to lead our help desk. This seat is the technical backbone of the service desk: you work the live ConnectWise board every day, you are the first escalation point for L1 work, you carry the daily operational controls (backup audits, patch review, alert triage), and you own client tickets from open to closure. You will be a trusted technical voice in front of customers, in English and in Spanish.

You'll work across a dozen-plus client environments, which means constant context switching between different networks, stacks, and people. If you need one quiet system to focus on, this is the wrong seat. If you like closing twelve to twenty tickets a day, fixing the thing that keeps coming back, and being the person the team relies on, keep reading.

This is not entry-level help desk. This is hands-on troubleshooting, system awareness, disciplined documentation, and ownership.

Why this seat matters

The engineer in this role typically handles a fifth of all ticket work at FUNCSHUN and the majority of the on-call rotation. It is the highest-volume, most client-facing technical seat in the company.

Responsibilities

Own the live board

• Work the Help Desk board daily: triage new tickets, set priority and type correctly, schedule work, and keep every ticket moving toward closure with same-day time entries and clear notes.
• Resolve L1/L2 tickets across Microsoft 365 (Entra ID, Exchange Online, Intune, Conditional Access), Windows 10/11, Windows Server, printers and peripherals, line-of-business apps (Sage, Autodesk, QuickBooks, LEAP, Toast), and networking (WatchGuard, UniFi, Starlink).
• Run the morning stand-up ticket review and the mid-day board check; flag SLA risk and blockers early.
• Take your turn in the on-call rotation and respond to after-hours incidents per the on-call runbook.

Run the daily and weekly controls

• Perform the Daily Server Backup Audit (Acronis) every business day and open remediation tickets for any failed or missing job.
• Run the weekly patching review: confirm NinjaOne patch compliance for client workstations and servers, schedule maintenance windows, and follow up on machines that fall out of policy.
• Triage RMM alerts (offline servers, CPU/disk thresholds, service failures) and Managed SOC / MDR alerts; take first-response actions and escalate to the CTO with evidence.

Deliver security work on client tenants

• Execute standardized security rollouts: MFA enrollment and migrations (Duo, Entra External MFA), Conditional Access policy reviews, BitLocker enablement, Keeper password manager onboarding, ThreatLocker allowlisting, Defender and RocketCyber configuration.
• Perform user onboarding/offboarding, device provisioning, and access reviews, following FUNCSHUN checklists and leaving an evidence trail in the ticket.
• Lead small client projects: workstation and server refreshes, network segmentation, domain and DNS moves, application deployments — scoped, scheduled, and closed in ConnectWise.

Improve the system

• Identify root causes on repeat issues and recommend fixes or escalations with evidence, not band-aids.
• Maintain accurate documentation in IT Glue / SharePoint; follow and improve SOPs; flag gaps.
• Coach junior technicians and hand back work that belongs at L1 with clear instructions.

How we work

• AI is part of your toolkit. We use Claude, Copilot, and similar tools daily to draft runbooks, write PowerShell, interpret logs, and speed up research. We expect you to do the same and to show us how. We also expect you to know what never goes into a public model: client names, credentials, PII, or anything covered by our AI Use Policy.
• Everything happens in the ticket. If it isn't in ConnectWise, it didn't happen. Time entries are logged in real time, in 10-minute increments during troubleshooting, with screenshots where applicable.
• Security is not a department. You'll be asked "why is this the secure way?" on ordinary tickets.
• Direct communication. We'd rather hear "I'm stuck" at hour one than a heroic silence at hour six.
• Ownership. You close what you open. Nobody chases you.

Success milestones

• By day 30: working the board independently within SLA with complete notes and same-day time entries; running the Daily Server Backup Audit and weekly patch review without prompting; first on-call shift completed.
• By day 60: escalations to the CTO arrive with evidence and a proposed fix; at least two repeat-issue root causes identified and eliminated; first SOP rewritten; first client security rollout (MFA, BitLocker, or Keeper) delivered end to end.
• By day 90: handling priority incidents independently; first small client project delivered; ticket backlog for your queue trending down; clients recognize you by name.

Milestones are reviewed at each checkpoint; the day 30 checkpoint doubles as the end of the paid trial period.

Must-have stack

• ConnectWise Manage (PSA) and an RMM — NinjaOne preferred; Automate, Datto or Kaseya acceptable
• Microsoft 365 administration: Entra ID, Exchange Online, Intune, Conditional Access, SharePoint/OneDrive
• Windows 10/11 and Windows Server troubleshooting (AD, GPO, DNS/DHCP, file services, Hyper-V basics)
• PowerShell scripting for repeatable admin tasks
• Backup platforms (Acronis a strong plus) — job monitoring, restores, and audit reporting
• Security tooling: EDR/MDR, MFA rollouts (Duo / Entra), application allowlisting (ThreatLocker a strong plus), password managers (Keeper), phishing response
• Firewalls and networking fundamentals — WatchGuard or UniFi a plus
• Microsoft Teams and SharePoint / IT Glue-based documentation

Qualifications

• 4+ years at an IT or security services provider supporting multiple clients simultaneously (not a single internal IT department)
• Strong troubleshooting skills and a root-cause mindset
• Security-aware by default
• Demonstrated daily use of AI tools in technical work — be ready to show examples
• Fluent in English and Spanish, written and spoken
• Clear, concise documentation and client communication
• Accountability mindset; comfortable with high ticket volume and frequent context switching
• Nice to have: MS-102, AZ-104, SC-200, Security+ / CySA+; exposure to PCI DSS, FTC Safeguards, or CMMC evidence collection; incident response experience; experience with condominium associations, law firms, or construction trades clients

Terms

• Full-time independent contractor, 40 hrs/week, long term, US Eastern business hours (9–6 ET) with occasional after-hours maintenance windows and a shared on-call rotation
• Rate depending on depth of experience
• All work performed on a FUNCSHUN-provided virtual desktop with MFA
• Background and reference checks required before access to client environments
• Paid 30-day trial against the day 30 milestones above, then ongoing

How to apply

Apply with a short note (English or Spanish) and your résumé. Include one example of a repeat issue you eliminated at a previous employer and one example of how you use AI tools in your daily technical work. Candidates who make it to the technical interview will be asked to work a sample ticket live.

Equal opportunity

FUNCSHUN is an equal opportunity employer. We evaluate candidates on skills, experience, and the way they work — nothing else.

Classification: Public · FUN-HR-JD-001 v1.0 · Hiring manager: Luis Arango, CTO · Posted: September 2026