Infrastructure Engineer II

About The Change Company

We take our mission to bank the underbanked seriously, fairly and responsibly. We bring digital-first banking, lending, and financial services to underserved communities, transforming the financial landscape.

We are a diverse, inclusive, and entrepreneurial organization that values collaboration, innovation, and customer focus. Our experienced leadership team drives growth and long-term success while serving tens of thousands of customers through responsible lending and banking solutions.

We have an experienced leadership team who have served in various fintech, banking and lending industries. We are a Community Development Financial Institution (CDFI) serving 50,000+ borrowers with over $10 Billion in loans since our CDFI certification. 

Join us in building modern, data-driven platforms that power financial inclusion and innovation.

About the Role

The Infrastructure Engineer II reports directly to the VP, Infrastructure and shares day-to-day ownership of the platform our lending business runs on: our Cato Networks SASE fabric and Cisco and Meraki campus network, our identity estate across Okta SSO, Entra ID, and Active Directory, our co-located data center and virtualization footprint, and the controls that protect borrower non-public personal information (NPI).

This is a hands-on individual contributor role on a small team. You will own defined areas outright and run changes end to end — design, validation, rollback plan, and documentation — while the VP and senior engineers set overall architecture and review the higher-risk work. We are looking for someone who has already operated production infrastructure, brings an automation-first instinct, and has the judgment to know which changes need a second pair of eyes in a regulated, examined environment.

Essential Job Duties / Responsibilities

Network Infrastructure

• Own day-to-day operation of the Cato Networks SASE platform — site and socket health, internet and firewall access policy, ZTNA rules for remote users, and traffic and bandwidth analysis — and design and implement policy changes with peer review.
• Own configuration and lifecycle of Cisco and Meraki switching across the colocation facility and corporate offices: VLAN and trunk design, stacking, PoE, port security, firmware currency, and routing changes (BGP, OSPF, and inter-VLAN) including planning, validation, and rollback.
• Own the Meraki wireless environment end to end — site surveys and access point placement, SSID and RADIUS design, channel and power tuning, client troubleshooting, and firmware lifecycle.
• Own DNS, DHCP, and IPAM as authoritative records and manage the certificate lifecycle; troubleshoot at the packet level using Cato and Meraki analytics alongside switch-level captures.
• Manage carrier circuits, cross-connects, last-mile providers, and bandwidth capacity planning; drive carrier escalations to resolution and evaluate circuit changes against cost and redundancy.

Voice and Collaboration

• Own the Vonage cloud VoIP platform — user and extension provisioning, call flow and IVR design, ring groups, voicemail, device lifecycle for desk phones and softphones, and E911 record accuracy.
• Diagnose call quality end to end across LAN QoS, Cato WAN policy, and carrier-side issues, and drive Vonage support cases through to root cause.

Identity, Single Sign-On, and Directory Services

• Own Okta administration — application assignments, group and app rules, sign-on and MFA policies, Okta Verify, and lifecycle rules for joiners, movers, and leavers — and improve those rules rather than only executing them.
• Lead SSO onboarding for new applications end to end: SAML and OIDC integration, attribute mapping, SCIM or just-in-time provisioning, pilot testing, cutover, and documentation, working directly with application owners and vendors.
• Administer Microsoft Entra ID alongside Okta — user and group lifecycle, role and license assignment, and the federation between the two — and keep entitlements consistent across both.
• Own on-premises Active Directory and the integrations that depend on it: organizational unit and group policy design, DNS, domain controller health and patching, the Okta AD agent, Entra Connect, and service account governance.
• Design and tune MFA and Conditional Access policy across Okta and Entra, balancing risk against user friction, and investigate authentication failures and suspicious sign-ins using Okta system logs and Entra sign-in logs.
• Automate identity operations with PowerShell and the Okta API — bulk provisioning, entitlement reporting, license reclamation, and access review data pulls — using the Microsoft Graph, Exchange Online, and Active Directory modules on the Microsoft side.

Co-located Data Center and Virtualization

• Own capacity and lifecycle in the colocation facility: rack elevations, A/B power and PDU load, cooling headroom, structured cabling, cross-connects, and hardware refresh planning, and coordinate smart-hands and maintenance windows with the facility.
• Administer VMware vSphere and Microsoft Hyper-V in parallel — cluster and datastore configuration within established standards, virtual machine provisioning and right-sizing, host firmware and patching, SAN/NAS storage, and capacity forecasting.
• Own backup operations in Druva: policy and retention configuration, job health, failure remediation, restore testing, and documented recovery of files, virtual machines, and applications.
• Own VMware replication to the recovery site — replication configuration against RPO targets, health and lag monitoring, remediation, and planning and executing scheduled failover tests with written results.
• Maintain out-of-band access (console servers, iDRAC/iLO) and author recovery runbooks another engineer can follow.

Cyber Security

• Apply and enforce least-privilege and zero-trust principles, harden systems to CIS Benchmarks, and own segmentation between production, corporate, vendor, and NPI zones in Cato policy and on the switch fabric.
• Run vulnerability management for your areas end to end — authenticated scanning, severity-based patch SLAs, remediation tracking, and documented risk acceptances with compensating controls.
• Investigate EDR, SIEM, and Cato security alerts — IPS, anti-malware, and DNS and URL filtering — tune detections to cut false positives, and take an active role in incident response through containment, recovery, and post-incident review.
• Own privileged access, service account hygiene, secrets rotation, and periodic access reviews across the infrastructure estate.
• Maintain encryption in transit and at rest, TLS and certificate standards, and email authentication with SPF, DKIM, and DMARC.

Automation and Scripting

• Automate repetitive server, network, and identity administration with PowerShell — take work that is done by hand today and turn it into something repeatable and documented.
• Build and maintain a shared library of reusable PowerShell scripts and modules for provisioning, reporting, and health checks, with parameters, error handling, and logging rather than one-off snippets.
• Write and maintain Ansible playbooks for server and appliance configuration, and automate configuration backup and compliance checking for Cisco and Meraki devices.
• Help set scripting standards for the team — naming, structure, comments, and change records — so the next engineer can pick up and run what you wrote.

Operations, Support, and Compliance

• Take a full share of the on-call rotation as primary responder, and plan and execute after-hours change windows with validation steps and a tested rollback plan.
• Own monitoring in LogicMonitor — coverage as the environment changes, threshold and escalation design, dashboard quality, and continuous reduction of alert noise.
• Resolve infrastructure tickets escalated from the help desk, and keep network diagrams, IP plans, asset inventory, and runbooks current.
• Implement and evidence infrastructure controls under the GLBA Safeguards Rule, SOC 2, and applicable investor and state requirements.
• Act as a technical contributor during internal audit, external audit, investor and warehouse lender reviews, and regulatory examinations — producing evidence and explaining the controls in your areas.
• Take part in business continuity and disaster recovery testing and help keep the technology portions of those plans current.
• Support and mentor junior engineers and help desk staff — review their changes, take their escalations, and write down what you know instead of keeping it in your head.
• Complete special tasks as assigned by manager as needed.
• Regular on-site attendance.

Qualifications

What Skills & Requirements You'll Need

Required

• 3–5 years of hands-on enterprise infrastructure experience across networking, systems, and virtualization, including independent ownership of production changes.
• Solid enterprise networking skills: VLAN and trunk configuration, inter-VLAN routing, firewall policy, wireless, and structured troubleshooting from the packet up — on Cisco, Meraki, or comparable platforms.
• Hands-on administration of Okta, Entra ID, and Active Directory, including SSO application onboarding and MFA or Conditional Access policy.
• Production experience with a SASE, next-generation firewall, or SD-WAN platform — Cato, Palo Alto, Fortinet, Zscaler, or similar.
• Windows Server and Linux administration: patching, services, logs, performance troubleshooting, and hardening.
• Working PowerShell ability at a level where you automate real work — parameterized scripts with error handling, not just one-liners.
• Practical security engineering habits: segmentation, patch and vulnerability management, access control, and participation in real incidents.
• Availability for on-call rotation, after-hours change windows, and incident escalation.
• Clear written communication — runbooks, change records, and diagrams, and the ability to explain technical risk and tradeoffs to non-technical business leaders.
• Comfort planning and executing your own change windows, including validation and rollback, and the judgment to know which changes need senior review.
• Understanding of the mortgage industry, or of another regulated environment, and the handling requirements for borrower NPI.
• Production experience administering a hypervisor platform — VMware vSphere, Hyper-V, or both — including clusters, storage, patching, and capacity, plus ownership of enterprise backup and restore testing.
• Bachelor’s degree or equivalent work experience.

Preferred

• Experience in mortgage, banking, or another regulated financial services environment.
• Professional- or specialty-level certification such as CCNP Enterprise, Microsoft SC-300 or MS-102, Okta Certified Administrator, VMware VCP-DCV, or CompTIA Security+.
• Hands-on experience with the platforms we run: Okta, Cato Networks, Cisco and Meraki, VMware vSphere, Hyper-V, Druva, LogicMonitor, or Vonage.
• Configuration management and automation tooling — Ansible, Microsoft Intune, or Microsoft Endpoint Configuration Manager.
• Microsoft 365 workload administration — Exchange Online, SharePoint, and Teams.
• Experience leading a discrete infrastructure project end to end: a switch refresh, a colocation move, an SSO migration, or a backup platform change.
• Experience serving as a technical contact during SOC 2, GLBA, investor, or warehouse lender examinations.
• Scripting against an identity API — Microsoft Graph or the Okta API.
• Experience mentoring junior engineers or help desk staff and setting technical standards.
• Familiarity with an IT service management platform such as Jira Service Management or ServiceNow.

Physical Demands and Work Environment

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential job functions of this position. Reasonable accommodations may be made to enable individuals with disabilities to perform the functions. While performing the duties of this job, the employee is regularly required to: communicate and accurately exchange information with clients at normal speaking levels; remain standing for sustained periods of time; use hands to finger, grasp, or feel; reach by extending hand(s) and arm(s) in any direction; have visual acuity to view a laptop, determine the accuracy, neatness, and thoroughness of the work assigned. Working conditions are generally moderate and in an office environment.

This position also requires regular work in a colocation data center environment, including racking and cabling equipment, working in cold aisles, and lifting equipment weighing up to 50 pounds, as well as participation in an on-call rotation with scheduled after-hours maintenance windows.

Note

This job description is meant to describe the general nature and level of work being performed; it is not intended to be an exhaustive list of all responsibilities, duties, and skills required for the position. While this is intended to be an accurate reflection of the current job, the Company reserves the right to revise the job or to require that other or different tasks, duties, and responsibilities be performed as assigned, or to otherwise change this job description at any time with or without notice.

The company is an Equal Opportunity Employer, drug free workplace, and complies with ADA and State regulations as applicable.