System Administrator

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes: About REP (company description) but not needed as heading? The instruction: Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. So we need sections like About the role (maybe summarizing role description), Responsibilities (essential functions), Requirements (what you will bring), Qualifications (Education and/or Experience), Skills (maybe from requirements), Benefits (maybe from description: hybrid work environment, office perks, etc.), Pay (not mentioned), Schedule (maybe hybrid work environment with minimum three days in office). The posting mentions: "We offer a hybrid work environment with a minimum of three days in the office, but there’s flexibility about which days and hours." That's schedule info. Also benefits: "state-of-the-art headquarters in Colorado with a bright, spacious, shared workspace; scenic views of the Rocky Mountains; and a kitchen always stocked with healthy snacks, protein powder, and coffee." Also maybe other benefits not explicit. Pay not mentioned, so we should NOT create Pay section. Benefits we have content. Schedule we have content. We need to preserve all substantive information, not invent. Remove boilerplate etc. We need to output only HTML fragment, no /, no markdown fences. We need to use

• for any list of duties/requirements/benefits, and

  for prose. We need to decide what goes where. About the role: likely the paragraph "About This Role" describing role purpose. Could be a prose

  . Responsibilities: list of essential functions (the bullet points under Essential Functions). Those are many items; we can make a

  with each essential function as
  • . Might be long but okay. Requirements: maybe the "What You Will Bring To perform this job successfully..." section includes list of knowledge/skill/ability required. Could be a
    . Qualifications: Education and/or Experience section: Bachelor's degree preferred, 5-8 years experience etc. Could be a
    or

    . Use list. Skills: maybe combine some of the requirements? But we already have Requirements. The instruction says we can have Skills section if posting has real specific content for it. The posting includes many skill items in "What You Will Bring". Could treat that as Skills. But we already have Requirements. Might be overlapping. Better to follow typical sections: About the role (role description), Responsibilities (essential functions), Requirements (what you will bring), Qualifications (education/experience), Benefits (office perks, hybrid work), Schedule (hybrid work details). Skills maybe not needed if covered in Requirements. But we could still include Skills if we want, but we must not create filler. The posting does have explicit skill list; we could put that under Skills. However the "What You Will Bring" includes both knowledge/skill/ability and also some experience. Might be better to split: Requirements = knowledge/skill/ability (the bullet list), Qualifications = education/experience. Then Skills could be omitted or we could combine. To avoid duplication, we can omit Skills section. Thus sections: About the role, Responsibilities, Requirements, Qualifications, Benefits, Schedule. Now we need to extract content. About the role: The paragraph after "About This Role": "REP is hiring a Systems Administrator to own the technology the company runs on: our Microsoft 365 tenant, identity and access, 200+ Windows and macOS endpoints, the network across all sites, and the dozens of software platforms the business relies on daily. You'll be the primary technical resource for the organization and accountable for keeping systems up, secure, and recoverable. The role is split between service and engineering. Service means responding to a broken laptop, a new hire first day, a down time clock on the warehouse floor, or a store associate who can't ring a sale. Engineering means deploying config and policy via tested scripts, automating identity lifecycle from our HRIS, tuning application-control and network policy, and eliminating recurring manual requests for good. We're growing, and this is an opportunity to support our employees across our four sites in our retail stores and additional distribution centers (California, Colorado, and Pennsylvania). Support can't scale by adding headcount; we need someone who builds leverage instead. You'll report to the Manager of IT Operations and work alongside our Systems, Web Development, and AI/Data teams, our outsourced SOC, and regional IT/network partners. This is an on-site role at our Colorado HQ, with occasional travel to distribution centers and retail locations." We'll put that as

    . Responsibilities: The list under "Essential Functions" with subheadings: Microsoft 365, Identity and Access Administration; Endpoint Management and Device Lifecycle; Endpoint Security, RMM, and Security Operations; Network, SASE, and Site Infrastructure; DNS, Email Security, and Data Protection; Automation and SaaS Platform Administration; End-User Support, Documentation and Enablement. We need to capture each bullet as a list item. The subheadings could be part of the li text. We'll produce

    with each essential function as
    • containing the description. We must preserve all substantive information; we can include the subheading as part of the li. Let's extract each: 1. Microsoft 365, Identity and Access Administration - Administer REP’s Microsoft 365 tenant — Exchange Online, SharePoint Online, OneDrive and Teams — including tenant configuration, service health, mail flow and message hygiene, retention and data governance. - Administer Entra ID as a controlled lifecycle: user and group lifecycle, role-based access, licensing, Conditional Access, MFA and password less methods, and SSO/SAML/SCIM integrations for enterprise applications. - Maintain least privileged standards and run periodic access reviews. We could combine into one li or split. Probably better to keep each bullet as separate li under the main heading? But the instruction: use
      • for any list of duties/requirements/benefits. So we can treat each duty as li. We'll break down each sentence. Thus:
      • Administer REP’s Microsoft 365 tenant — Exchange Online, SharePoint Online, OneDrive and Teams — including tenant configuration, service health, mail flow and message hygiene, retention and data governance.
      • Administer Entra ID as a controlled lifecycle: user and group lifecycle, role-based access, licensing, Conditional Access, MFA and passwordless methods, and SSO/SAML/SCIM integrations for enterprise applications.
      • Maintain least privileged standards and run periodic access reviews.
      Similarly for Endpoint Management and Device Lifecycle: - Own the complete device lifecycle for 200+ Windows and macOS endpoints plus the iPadOS and kiosk fleet: Windows Autopilot and Apple Business Manager/ADE enrollment, Intune configuration profiles and compliance policies, application packaging and deployment, driver and OS patch rings, BitLocker and File Vault encryption with key escrow, procurement, imaging, refresh, secure decommissioning, hardware standards and asset tracking, and equipment provisioning and shipping to remote employees. - Deliver fleet-wide changes through tested, version-controlled scripts using staged rollout and documented rollback. We'll split. Endpoint Security, RMM, and Security Operations: - Own the remote monitoring and management and application-control platforms (Ninja One and Threat Locker) end to end - deployment and agent health, policy creation and tuning, allowlisting and elevation request handling, remote support sessions, automated patching and script execution. - Serve as primary point of contact for REP’s outsourced SOC: triage, investigate and remediate escalated alerts such as impossible travel, anomalous sign-in and unusual IP activity; coordinate containment and document findings; support endpoint protection coverage and hygiene alongside the SOC-managed Sentinel One instance. - Issue third-party and API credentials only against a governed register with defined owner, scope and expiration. Network, SASE, and Site Infrastructure: - Own REP’s Cato Networks SASE environment - site and endpoint client deployment, firewall and security policy, SD-WAN across locations, QoS and traffic shaping, VPN and remote access, and network performance monitoring and troubleshooting. - Manage on-premises infrastructure across REP facilities: wireless access points and coverage, network switching and structured cabling, printers and print management including distribution-center label printers and print/pack station technology, time clocks and scanners, and conference-room and AV technology. DNS, Email Security, and Data Protection: - Own DNS for the corporate domain and the website, including records and domain configuration. - Manage email authentication (SPF, DKIM and DMARC), quarantine review and release, and investigation of user-reported phishing and suspicious messages. - Administer backup and recovery for Microsoft 365 data - Exchange Online, SharePoint, OneDrive and Teams - through REP’s third-party backup platform and maintain protection for on-premises creative storage; monitor coverage and job health, perform periodic restore testing, and document recovery procedures. Automation and SaaS Platform Administration: - Design and build automations that eliminate manual IT work, with particular focus on identity lifecycle automation driven from the Rippling HRIS - automated onboarding, role and department changes, and same-day offboarding across all connected platforms - using PowerShell, the Microsoft Graph API and native platform integrations. - Serve as technical administrator for REP’s SaaS portfolio: provisioning and deprovisioning, permission structures, group and role assignment and access auditing, and maintenance of the tenant register (named administrators, break-glass access, license counts and renewal dates). - Partner with business system owners such as NetSuite and Shopify who manage day-to-day platform configuration, while retaining ownership of access and identity governance. End-User Support, Documentation and Enablement: - Serve as the primary technical resource for the organization across tier 1 through tier 3 - from account and hardware requests to complex platform, network and security troubleshooting - for corporate, distribution center and, as stores open, retail staff. - Manage the ticket queue, set response expectations and drive issues to resolution. - Act as a technical point of contact with platform vendors, resellers and service providers, driving support cases, vendor on-site work, and warranty and RMA logistics. - Maintain documentation of infrastructure, configurations, integrations and runbooks; contribute to IT policy, standards and business-continuity and disaster-recovery planning; and deliver security awareness, phishing simulation and user enablement. Now Requirements: The "What You Will Bring To perform this job successfully..." section includes a list of knowledge, skill, and/or ability required. Let's extract each bullet: - Microsoft 365 and Entra ID: hands-on tenant administration including Exchange Online, SharePoint, OneDrive and Teams; Conditional Access, MFA and passwordless, licensing, and SSO/SAML/SCIM application integrations. - Endpoint management at scale: Microsoft Intune for both Windows and macOS, including Autopilot, Apple Business Manager/ADE, compliance policies, application deployment and patch management. - RMM and endpoint security tooling: NinjaOne or comparable RMM; application allowlisting and zero-trust endpoint control (ThreatLocker or comparable); endpoint protection / EDR. - Scripting and automation: PowerShell strongly preferred; Microsoft Graph API and HRIS-driven identity automation (Rippling or similar) highly valued; comfort working in version control - Networking and SASE: routing, switching, wireless, VLANs, firewall policy, VPN, SD-WAN and QoS; experience with a SASE platform (Cato Networks preferred) is a strong plus. - DNS and email security: DNS administration for production domains, SPF, DKIM and DMARC, quarantine management and phishing investigation workflows. - Backup and recovery: third-party backup for Microsoft 365 workloads, restore testing and documented recovery procedures. - SaaS administration: multi-tenant business application administration, license management, access auditing, and governance of API keys and service