2nd Line Service Desk Engineer

SUMMARY:
The 2nd Line Service Desk Engineer acts as the primary escalation point for unresolved 1st line incidents and service requests, taking ownership of advanced troubleshooting and root-cause analysis across client environments.

POSITION INFO:

2nd Line Service Desk Engineer

Take ownership of complex escalations, advanced troubleshooting, cybersecurity incidents, and infrastructure support across client environments.

Cape Town – Wembley Square | Office-based | Monday to Friday, UK hours | R40,000 – R50,000 per month

ABOUT OUR CLIENT

Our client provides IT services and technical support across client environments, covering endpoints, servers, networks, Microsoft platforms, security tooling, and infrastructure.

Their technical environment includes Windows, Microsoft 365, Active Directory, Azure AD / Entra ID, Datto RMM, endpoint security, email security, firewalls, vulnerability management, and networking technologies.

THE ROLE: 2ND LINE SERVICE DESK ENGINEER

The 2nd Line Service Desk Engineer acts as the primary escalation point for unresolved 1st line incidents and service requests, taking ownership of advanced troubleshooting and root-cause analysis across client environments.

The role covers cybersecurity and threat mitigation, system and infrastructure management, advanced identity and access management, technical documentation, and escalation control. It also involves supporting 1st line engineers and preparing comprehensive handovers when issues require 3rd Line Engineers, Security Specialists, or dedicated project teams.

KEY RESPONSIBILITIES

Escalation & Advanced Troubleshooting

• Act as the primary escalation point for unresolved 1st line incidents and service requests.
• Perform deep-dive diagnostics and root-cause analysis on complex IT issues across client environments.

Cybersecurity & Threat Mitigation

• Investigate and remediate security alerts, malware infections, suspicious emails and phishing attempts, and unauthorised access attempts.
• Support and maintain security tooling, including Endpoint Detection and Response (EDR/MDR), email security gateways, firewalls, and vulnerability management tools.
• Enforce security baselines, ensuring patch management via Datto RMM, hard-disk encryption through BitLocker, and endpoint security compliance across all managed devices.
• Assist with security incident response, containment, and post-incident analysis for client environments.

System & Infrastructure Management

• Remotely manage, monitor, and maintain client endpoints, servers, and network infrastructure using Datto RMM, TeamViewer, and AnyDesk.
• Troubleshoot and resolve advanced issues involving Windows 10/11, Windows Server 2016–2025, Microsoft 365 administration, Active Directory, Group Policy, and Azure AD / Entra ID.
• Diagnose complex networking issues, including VPN configurations, DNS/DHCP, firewalls, switches, and Wi-Fi networks.

Advanced User & Access Management

• Handle complex identity and access requests following the Principle of Least Privilege, including multi-domain Active Directory configurations, security group structures, Exchange Online policy adjustments, and advanced MFA/Conditional Access troubleshooting.
• Oversee complex user onboarding and offboarding workflows involving customised permissions, secure offboarding procedures, and software deployments.

Documentation & Knowledge Sharing

• Create, maintain, and update detailed technical documentation, network diagrams, security protocols, and standard operating procedures (SOPs) in the IT knowledge base.
• Ensure all escalated tickets are updated with accurate work logs, technical root causes, and clear steps taken toward resolution.

Mentorship & Escalation Control

• Review incoming walk-up notes and ticket transfers from 1st line engineers, providing direct feedback and guidance to help upskill the team, including security awareness training.
• Recognise when an issue exceeds 2nd line scope and prepare comprehensive handoff documentation for 3rd Line Engineers, Security Specialists, or dedicated project teams.

ABOUT YOU

• Hands-on experience with security tools including EDR/AV solutions, spam/phishing filters such as Mimecast and Defender for Office 365, and SIEM/SOC alert monitoring.
• Solid understanding of zero-trust concepts, MFA implementation, password policies, and framework baselines such as Cyber Essentials and NIST.
• CompTIA Security+, CySA+, Microsoft SC-900, SC-300, MS-500, or equivalent practical security exposure is advantageous.

WORKING HOURS

Monday to Friday, 09:00 am – 17:30 pm UK Time.

Occasional shift cover may include 08:00 am – 16:30 pm UK Time or 09:30 am – 18:00 pm UK Time.