How to get hired as a systems administrator in 2026-27

What a systems administrator actually owns, and the titles that mean the same job

A systems administrator owns running systems. That is the whole distinction, and it is the one most candidates fail to make on paper. A help desk technician is measured on tickets closed and users unblocked. A systems administrator is measured on whether the thing itself keeps working: whether the domain controllers are healthy, whether patches landed on the agreed share of endpoints inside the window, whether the backup that ran last night can actually be restored, whether the certificate that expires in March gets renewed before it expires rather than at 6am on a Saturday.

In practice the estate is some mixture of: identity, meaning Active Directory and Entra ID or Okta, group and role structure, joiner-mover-leaver process, multi-factor authentication and Conditional Access; email and collaboration, usually Microsoft 365 or Google Workspace with whatever is left on-premises; endpoint management, meaning Intune and Autopilot for Windows, often co-managed with Configuration Manager in older estates, Jamf for Macs, imaging or provisioning, software deployment, local admin rights; servers and the hypervisor or cloud under them; networking at the level of DNS, DHCP, VPN and the firewall rules you asked for; monitoring and alerting; and backup, which in 2026 means an immutable or air-gapped copy and a restore you have tested on purpose.

The job also has a non-technical core that interviews probe harder than candidates expect: change control, documentation, vendor management, licence true-ups, and telling a senior person no in a way that leaves you both employed. A systems administrator who cannot produce a runbook is a single point of failure, and experienced hiring managers have been burned by exactly that.

The same job is posted under a long list of titles. Search for the work, not the words.

• Direct synonyms worth searching: Systems Administrator, Sysadmin, IT Systems Administrator, Systems Engineer, Infrastructure Engineer, IT Infrastructure Administrator, Network and Systems Administrator, IT Operations Engineer, Systems Administrator II or III.
• Platform-narrowed versions of the same job: Windows Systems Administrator, Linux Systems Administrator, Microsoft 365 Administrator, Endpoint Engineer, Modern Workplace Engineer, Identity Administrator, VMware Administrator, Virtualisation Administrator, Backup Administrator.
• Corporate IT at technology companies, where the fleet is Mac-heavy and automation is assumed: Corporate Engineering, IT Engineer, Workplace Technology Engineer, Client Platform Engineer.
• Adjacent but genuinely different, and applying with a sysadmin resume wastes your time: Network Engineer (owns the path between things), DevOps or Site Reliability Engineer (owns the delivery path and the service objectives for a product the company sells, and expects code review), Cloud Engineer (owns accounts and infrastructure as code), Security Engineer (owns controls and detection), IT Manager (owns budget, vendors and people).

One title trap worth naming: DevOps Engineer is sometimes used by non-technology employers to mean a systems administrator who also touches a CI pipeline. Read the responsibilities, not the heading. If the posting lists Active Directory, Group Policy, Veeam and a ticket queue, it is a sysadmin job regardless of the title, and you should answer it as one.

The reverse trap costs more. A genuine platform or SRE posting at a product company will screen for code in a repository, a testing story, and ownership of a service with error budgets. Applying to those with a resume made of migrations and patch compliance reads as a career change, which it is, and needs a different pitch rather than the same resume with the word DevOps inserted.

The five employers hiring sysadmins, and why that choice matters more than the title

The single biggest determinant of what your next three years look like is not the title or even the pay. It is which type of employer you join. They hire differently, interview differently, value different evidence, and leave you with different options afterwards. Work out which you are looking at before you write a word of the application.

• Internal IT at a non-technology company. Manufacturing, healthcare, legal, construction, logistics, distribution, education, local government, retail head offices, hotels. This is the majority of all systems administrator jobs. The stack is usually Windows plus Microsoft 365, some Linux, one headquarters and some number of sites or plants, a hypervisor estate, and genuine hands-on hardware work. You will be onsite most days because servers, switches and laptops are physical objects. Breadth is enormous, depth is whatever you make it, and the quality of the job depends almost entirely on your manager.
• A managed service provider. MSPs hire constantly, interview fast, and often offer within a week. You will see dozens of environments in a year, which is the fastest technical education available in this field, and you will do it under utilisation targets and timesheets with a queue that never empties. The tooling is a remote monitoring and management plus professional services automation stack: ConnectWise, Datto, NinjaOne, Kaseya, Autotask, Halo. Pay for the same skills usually sits below internal IT. Two to three years at a good MSP is the strongest possible start and a common cause of burnout at year four.
• Staffing firms and contract-to-hire. A large share of private-sector sysadmin work is posted by agencies rather than the employer, as a six or twelve month contract with a conversion option. It is the fastest way into a brand-name environment and into getting paid hourly for the Saturday cutover, and the trade is less job security, benefits that vary wildly, and a recruiter between you and the hiring manager. Ask three things before signing: the bill-to-pay relationship if they will discuss it, who holds the conversion decision, and whether overtime is paid at time and a half.
• Public sector and defence contractors. School districts, counties, state agencies, universities, hospitals, utilities, and the defence supply chain. Gated on a background investigation, often a drug screen, and for some work a clearance the employer sponsors over months. Defence work carries cyber workforce qualification requirements under DoD Directive 8140.01 and DoD Manual 8140.03, which in practice usually means holding a baseline qualification such as Security+ before you get privileged access. The Cybersecurity Maturity Model Certification programme rule took effect in December 2024 and the acquisition rule putting CMMC into new DoD contracts took effect in late 2025, so NIST SP 800-171 control and evidence work now lands on systems administrators in the defence supply chain. Slow hiring, scored panels, strong stability, published pay scales, real constraints on how fast you can change anything.
• Infrastructure or corporate IT at a technology company. Smaller in number, higher in pay, different culture: Mac fleets managed with Jamf, identity in Okta or Entra with SSO and SCIM everywhere, configuration in a repository with pull requests, and an expectation that you automate rather than click. Interviews here look more like software interviews, with a scripting exercise and a design discussion. Datacentre operations, hosting providers and research computing sit in this family too, with their own specialisations: remote hands, HPC schedulers, power and cooling.

Choose by the stack you want to be fluent in three years from now, because fluency is what gets you the job after this one. A candidate with four years of Windows, Microsoft 365, Intune and Veeam has a clear next step into identity, endpoint or security work. A candidate with four years of whatever the ticket needed, across six versions of everything, has breadth that is hard to prove and hard to price.

One warning about very small employers. A one-person IT department is the fastest way to own real scope early, and also the easiest place to spend five years with nothing you can describe to a stranger. If you take that job, take it with a plan: pick one project a year that has a start, a cutover, and a measurable result.

How systems administrator hiring actually works in 2026-27

This is not a software hiring loop and you should not prepare for one. There is usually no take-home project, no four-interview panel day, and no algorithm screen. There is a manager with an unfilled role and a queue that is behind, trying to find out two things: can you be trusted with privileged access to production in your second week, and will you still be here in two years.

The sequence, where there is one, looks like this.

• Application. Almost always through an applicant tracking system with knockout questions attached. The questions that eliminate most candidates are not technical: how many days onsite, will you join an on-call rotation, do you have a valid driver's licence, can you lift 50 pounds, are you authorised to work without sponsorship. Answer them honestly. A no on on-call is not fatal at every employer, but a yes you did not mean ends badly in month two.
• Screen, 15 to 30 minutes. Usually the hiring manager at a small employer, an internal recruiter at a larger one, an agency recruiter on a contract role, an HR analyst in public sector. Pay expectations, location, notice period, and a quick pass over your last environment. Have a one-sentence description of your estate ready: roughly 400 users across three sites, about 60 VMs on four VMware hosts, hybrid Entra, Veeam to an immutable repository, two of us on a one-week-in-two rotation. That sentence does more work than anything else you say.
• Technical interview, 45 to 90 minutes, with the IT manager plus a senior administrator or the person you would replace. Mostly scenarios, some depth questions, some tool specifics. This is where the offer is decided.
• Optional practical. A hands-on lab in a sandbox (join a machine to the domain, fix a broken GPO, correct share and NTFS permissions, write a PowerShell one-liner to list stale accounts), a short scripting exercise, or a whiteboard of the environment you most recently ran. More common at technology companies and MSPs than at internal IT.
• Stakeholder conversation. At internal IT, often a department head who will be your customer: the plant manager, the practice administrator, the head of finance. They are testing whether you can explain a problem without jargon and whether you will show up when their thing is broken. Do not treat this as a formality; people do get rejected here.
• Checks and offer. References, background check, sometimes a drug screen in manufacturing, healthcare, transport and government. For cleared work, the clearance process starts after the conditional offer and runs for months. Expect the written offer to specify on-call expectations and exempt or non-exempt status; read both.

Timelines, honestly: a week to a month at an MSP or through a staffing firm, two to six weeks at internal IT, two to six months in public sector, and longer again where a clearance has to be granted. If you need income soon, apply to MSPs and agencies in parallel with everything else, because they are the parts of this market that move quickly.

Where the postings actually are, by employer type: USAJOBS for federal, NEOGOV and GovernmentJobs for state, county and city roles, school district and university HR pages directly (their postings often never reach the big boards), the career pages of the MSPs within commuting distance of you (search for managed IT services plus your metro and apply to all of them), and LinkedIn, Indeed and Dice for private employers and agencies. Local employers with one IT person frequently post only on their own site and a local job board.

The two knockouts worth planning around are location and on-call. A large share of systems administrator work is onsite-bound because the hardware is in a building, and the remote postings that do exist attract very large applicant pools and usually want cloud and automation depth rather than general administration. If you want remote, aim at Microsoft 365 and identity administration, MSP remote support tiers, or cloud operations, and say in your first line that you work remotely in a named time zone.

Public sector deserves one specific tactic. The HR analyst screening you is comparing your application against the posting's stated minimum qualifications, often literally. If the posting says three years administering Windows Server and Active Directory, your application must contain those words attached to dates that add up. This is not keyword stuffing, it is clearing a check that a technical person never sees.

Certifications: which ones move a screen, and the one that is a contract condition

There is no licence for this work. That absence is why certifications carry so much weight at the screening stage: they are the only standard signal available to a non-technical filter. They matter in three specific places and almost nowhere else. HR screens and public sector minimum qualifications use them as pass or fail. Managed service providers need staff certifications to hold vendor partner tiers, so they will often pay for yours. And government contracts can mandate them outright.

That last case is the only one where a certification comes close to non-negotiable, and the detail matters because the rules changed. Work under US Department of Defense contracts falls under the cyber workforce framework in DoD Directive 8140.01, with the qualification requirements in DoD Manual 8140.03, which replaced the old 8570.01-M baseline certification tables. Under 8140.03 a person can be qualified by certification or by a combination of education, training and experience plus continuing education, so the blanket claim that Security+ is always legally required is wrong. In practice, individual contracts, contracting officers and company policies still specify a baseline certification, and privileged-access accounts are frequently gated on holding one, so the honest version is: read your contract's own requirement, and expect to be asked for Security+.

Beyond that, a technical interviewer will discount your certifications almost entirely and ask you questions instead. The exception is the hands-on exams, because they cannot be passed from a question dump.

• CompTIA. A+ is for help desk entry and does little once you have a job. Network+ is a reasonable foundation if your networking is weak. Security+ is the one with teeth, because of the DoD baseline and because it has become a generic HR proxy for having security awareness. Treat these as screen-passers, not as evidence.
• Microsoft, for the estate most of these jobs run on. AZ-104 Azure Administrator Associate is the most broadly recognised. MS-102 covers Microsoft 365 administration, SC-300 identity and access, MD-102 endpoint administration, and the AZ-800 and AZ-801 pair covers Windows Server hybrid work. Microsoft retires and renames exams regularly, so confirm the code, the price and the renewal rules on the current certification page rather than in a blog post. If you administer Microsoft 365 daily, SC-300 and MD-102 map most directly to what postings now ask for.
• Linux. Red Hat RHCSA, exam code EX200, is a hands-on practical exam in a live environment, and it is the credential Linux-heavy employers actually respect for that reason. RHCE, now Ansible automation, follows it. The Linux Foundation LFCS is cheaper and also performance-based. A multiple-choice Linux certification convinces nobody who runs Linux.
• Cloud and containers. AWS's SysOps Administrator Associate for AWS shops, AZ-104 for Azure, checking first that the exam is still current because AWS reshuffles its catalogue. The Certified Kubernetes Administrator is performance-based and open-book against the official documentation, which makes it genuinely hard if you have not used Kubernetes, which is exactly why it carries weight.
• Virtualisation, with a caveat. VMware certifications still appear in postings from shops that stayed on VMware, and the names and tracks changed under Broadcom, so check what the current equivalent of VCP is before paying. VMware skills remain in demand precisely because migrations off it need people who understand both sides. But the licensing changes moved the direction of travel, so Proxmox VE, Nutanix and Hyper-V experience is now worth as much on a resume as the certification is. If you are choosing where to spend a weekend, build a migration in a lab rather than sit an exam.
• MSP vendor certifications: ConnectWise, Datto, NinjaOne, Kaseya. Usually free, usually quick, valuable to exactly one employer type. Do them when you work there, not before.

If you have none and are trying to get the first job, the efficient order is: Security+ if you are anywhere near government or defence work, otherwise AZ-104 or MS-102 for the Microsoft path, or RHCSA for the Linux path. One certification plus a lab you can describe in detail beats three certifications and nothing to talk about, every time.

On degrees: a bachelor's is listed on many postings and waived in practice at most private employers, who will take equivalent experience. It stays a hard filter in three situations: public sector postings where the minimum qualification is written into a classification, federal GS classification, and visa sponsorship. If you have no degree, the certifications are doing more work for you, and the lab and project evidence are doing most of the rest.

What systems administrators are paid, and what moves it

Do not trust a salary number from an aggregator that does not say where it came from. Two sources are authoritative and free, and both beat a band someone quoted on a forum.

First, the US Bureau of Labor Statistics Occupational Employment and Wage Statistics code 15-1244, network and computer systems administrators. Read the percentile table and the state and metropolitan tables, not the national median: this code covers everyone from a two-year administrator at a school district to a principal administrator at a bank, and it includes network work, so the median describes nobody in particular. Your realistic target is a percentile band in your own metro, adjusted for employer type. The same agency's Occupational Outlook Handbook projects employment for this occupation growing more slowly than the average across all occupations; read the current entry for the figure rather than trusting a number you saw repeated. That is the real demand picture: a very large installed base of jobs turning over steadily, not a growth field.

Second, live postings in states that require a pay range by law, which currently include Colorado, California, Washington, New York, Illinois, Minnesota, Maryland, Massachusetts, New Jersey, Vermont, Hawaii and the District of Columbia, with several cities adding their own. Read those ranges even for jobs you are not applying to, because they are the only published numbers tied to a specific stack, level and city. A remote posting from a Washington employer tells you what that employer pays.

Federal and many public sector roles publish their scale outright. Federal systems administration sits in the GS 2210 IT specialist series, commonly with a parenthetical specialty, and the grade plus the locality pay table gives you the exact number before you apply. Universities, counties and school districts usually publish classification schedules too.

What actually moves pay for the same skill set, roughly in order of effect:

• Employer type. An MSP and an internal IT department in the same city, hiring for the same skills, can differ substantially, with the MSP lower. Finance, pharmaceuticals, energy and technology pay above education, nonprofit and local government for the same work.
• Geography and whether the role is onsite-bound. Onsite roles are priced to the local market. The remote roles that exist are priced nationally and competed for nationally.
• Specialisation. Identity and access, virtualisation migration, backup and disaster recovery, and Linux at scale all price above general administration. Generalists are paid for breadth, specialists for scarcity.
• Clearance. An active clearance is a durable premium in the defence market, for a simple reason: the employer avoids months of waiting. Nobody can grant it to themselves. If yours has lapsed, know the date your access ended, because reinstatement after a short break is far cheaper for an employer than a new investigation, and continuous vetting has replaced most periodic reinvestigations.
• On-call and shift. Ask directly whether on-call carries a stipend, whether call-outs are paid, and whether the role is exempt or non-exempt. Many systems administrator roles are classified exempt, which means Saturday cutovers are unpaid. A non-exempt or hourly contract role with overtime can out-earn a higher-banded exempt one.
• Title step rather than negotiation. Internal IT salary bands are usually narrow and tied to a job family. Moving from Administrator to Senior Administrator or Systems Engineer moves pay more than a strong negotiation inside one band does. If the band is capped, negotiate the title.

One negotiation note specific to this field: certification reimbursement, a training budget and lab or test hardware are frequently approvable when salary is not, because they come from a different budget line. So is a written on-call rotation size. Ask for those in writing in the offer, not verbally at the end of the interview.

The resume: make one environment legible in six lines

A systems administrator resume is read by someone deciding one thing: does this person's last environment resemble mine. Everything that helps them answer that belongs on the page, and everything else is noise. The failure mode is universal and easy to fix: candidates describe duties in adjectives and leave out every number that would make the estate real.

Compare two versions of the same job. Responsible for maintaining servers, troubleshooting hardware and software issues, and supporting end users in a fast-paced environment. Against: sole administrator for 310 users across two plants and a head office, 48 VMs on three Hyper-V hosts, hybrid Entra ID with Conditional Access and MFA on all staff accounts, Veeam to a hardened Linux repository with quarterly tested restores against a four-hour recovery time objective, monthly patch compliance reported above 97 percent. Same job. Only one of them can be assessed. Those numbers are an example of the shape; use your own, taken from your own reporting.

Quantify the environment with real units.

• People and devices: users supported, endpoints by platform, mailboxes, sites or buildings, time zones covered.
• Servers and platforms: physical versus virtual, VM count and host count, hypervisor and version, operating system versions still in the estate, tenant count, data volume protected in terabytes.
• Operational numbers from your own reporting, never invented ones: monthly ticket volume, patch compliance percentage, uptime for a named service, restore time measured in a real test, mean time to resolve if your ITSM reports it, size and frequency of the on-call rotation.
• Money, if you have it: licence spend you reduced at a true-up, hardware refresh budget you ran, the cost of the thing you consolidated. Numbers with currency attached get read twice.
• Projects with a date and a verb that implies ownership: migrated, cut over, consolidated, decommissioned, rebuilt, rolled out, recovered.

The projects landing interviews in this cycle are specific and recent, and if you ran any of them they belong at the top of the bullet list: a Windows 10 to Windows 11 fleet migration and what you did about the hardware that could not take it, including whether you had to buy Extended Security Updates to finish; Exchange Server 2016 or 2019 out of support and onto Exchange Online or Subscription Edition; Windows Server 2016 off the floor ahead of its January 2027 end of support; a hypervisor migration off VMware to Hyper-V, Proxmox or Nutanix with the licensing reason stated plainly; file shares to SharePoint or OneDrive with permissions actually reviewed rather than copied; on-premises Active Directory to a hybrid or cloud-first identity with MFA enforced and an exceptions process; a backup redesign with an immutable or air-gapped copy and a restore test on the calendar; a patch compliance programme that moved a number; audit or framework evidence work for SOC 2, HIPAA, PCI DSS, NIST SP 800-171 or CMMC; a cyber insurance questionnaire you had to answer truthfully, and the gaps you closed in order to.

What gets skipped by every reader: a cloud of sixty technology nouns with no context, responsible for as the opening of every bullet, Microsoft Office proficiency, excellent communication skills, certifications in progress listed as if earned (interviewers verify, and this one ends candidacies), and generic lines like troubleshoot hardware and software issues that describe the whole occupation rather than you. A home lab belongs at the top only if you have no professional experience; for an experienced candidate it goes last, briefly.

Format advice specific to this field: one column, standard headings, dates on every role including months, and the platform nouns spelled the way the posting spells them, with versions. These postings are noun-dense, the screens are noun-matched, and the human reader is scanning for the same words. Two pages is normal past a few years. Use the second page for environment detail rather than for more adjectives.

If you can attach artefacts, attach the right ones. A sanitised network or identity diagram, a runbook you wrote, or a small public repository of scripts with readable comments all prove things a bullet cannot. Sanitise properly: no real hostnames, no internal IP ranges, no user data, nothing that identifies a former employer's topology. A hiring manager who sees you publish an employer's internals learns something about you that outweighs the script.

The interview: scenario troubleshooting, and the judgment test underneath it

The technical interview for this role is a troubleshooting conversation, and what is graded is method rather than trivia. A good interviewer does not care whether you remember the exact event ID. They care whether you establish scope before acting, whether you ask what changed, whether you look at evidence instead of guessing, and whether you would run a destructive command in production without a change record. Candidates who narrate their reasoning pass. Candidates who leap to an answer and are wrong fail even when the answer was right.

The questions below come up constantly in some phrasing. For each, what a strong answer actually contains.

• A user says the network is slow. Scope first: one user, one subnet, one site, or everyone. Then establish the path and test it piece by piece rather than guessing: name resolution, the local link, the VPN or SD-WAN, the application itself. Say what you would measure, not what you suspect. The tell of a weak answer is naming a cause in the first sentence.
• Users at one site cannot reach a file share; another site can. Authentication versus name resolution versus path. Kerberos and time skew, DNS and the site's own resolver, DFS referrals, the firewall rule someone changed on Friday. Good answers ask what changed in the last 24 hours before touching anything.
• Logins are taking four minutes. Group Policy processing, logon scripts, drive and printer mapping, roaming or redirected profile size, slow link detection, a dead domain controller the clients are still trying. Mention how you would measure it, with gpresult, event logs, or Group Policy operational logging, rather than listing suspects.
• Our mail is going to spam. SPF, DKIM and DMARC, and specifically alignment rather than mere existence; reputation, and whether anything on your network is sending without going through the gateway; how you would read the headers of an actual rejected message. A candidate who says check SPF and stops has seen the problem in a blog post. A candidate who asks for a message header has solved it.
• A certificate expired on a Saturday morning. The honest answer is about inventory and renewal process, not the incident. What do you use to know every certificate's expiry date, who owns the renewal, and what did you change after the first time this happened to you.
• Walk me through what happens when a domain-joined laptop boots and a user signs in. A depth probe with no trick in it. DHCP, DNS, domain controller location, secure channel, Kerberos ticket, Group Policy, profile load, then the token the applications use. How far you get tells the interviewer your actual level in about 90 seconds.
• Tell me about your last outage. The most predictive question in the loop. Give a timeline: how you found out, what you checked, what you tried that did not work, how service was restored, what the root cause turned out to be, who you told and when, and the specific thing that is different now because of it. Say the part where you were wrong. Candidates who present a flawless outage are not believed.
• When did you last restore from backup, and what did you restore? We have backups is a failing answer, and interviewers have learned to ask it this way deliberately. Name the restore, the thing recovered, how long it took, and whether the measured time met the recovery objective you were supposed to meet. If you have never performed a restore, do one in your lab this week so that you can.
• The CFO wants MFA turned off for their phone. A judgment question, not a security quiz. What the exception process is, what you would offer instead, what you would record, who approves the risk, and when it gets reviewed. The wrong answers are both extremes: doing it, and refusing with no alternative.
• What is the last thing you automated? Expect a follow-up on how you tested it and what it broke. See the AI section below, because in 2026 this question usually has a second half about assistance.

If there is a practical lab, narrate continuously while you work and say what you expect each command to show before you run it. Interviewers are watching for whether you check before you change, whether you reach for documentation without embarrassment (everyone does; pretending otherwise is a tell), and whether you would have taken a backup or a snapshot before editing. A wrong command with good narration beats silent correctness.

Three things belong in the questions you ask them, because the answers predict whether the job is good: how many people are in the on-call rotation and what a typical week of pages looks like; what state the documentation is in and whether you would be inheriting an estate nobody has mapped; and what the last two significant projects were, which tells you whether this team does projects at all or only firefights. A manager who cannot answer the third question is describing a job with no career in it.

Finally, the thing that quietly decides a lot of these interviews: how you talk about users. The occupation has a tradition of contempt for the people it serves, and hiring managers at internal IT screen it out hard, because the department head in the next interview will notice it in thirty seconds. Describe a frustrating user problem as a systems problem and you will stand out more than you expect.

Getting in, and getting out: the ladder changed at both ends

The traditional route into this job was tier-one help desk for a year or two, then a junior administrator role. That rung is thinner than it was, and the reasons are mundane rather than dramatic: self-service password reset removed the single highest-volume ticket type, device provisioning moved to Autopilot, Jamf and MDM so imaging benches disappeared, software distribution became a portal, and more recently chat-based deflection answered another slice of the easy questions. Budget pressure and offshored first-line support did as much of this as any AI feature. Fewer tier-one seats means fewer places to be taught the basics on someone else's payroll.

Where the entries actually are in 2026-27, in rough order of how reliably they work.

• A managed service provider at tier one or tier two. Still the single most reliable way in, still hiring constantly, still the fastest learning available. Say in your application that you want breadth and expect a queue; they are screening for people who will not be shocked by it.
• The only IT person at a small company, posted as IT Support or IT Coordinator. Enormous scope immediately, nobody to learn from, and a real risk of stagnation. Take it with a plan to leave with named projects.
• Public sector and institutional IT: school districts, community colleges, counties, hospitals, housing authorities. They hire at lower experience levels than private employers because their pay is lower, their process is slower, and their stability is better. The minimum qualifications are literal, so apply with the posting's words in your application.
• Datacentre technician, remote hands, NOC technician. Shift work, strong hardware and process grounding, and a clear path into systems or network administration at the same employer.
• A staffing firm contract. Agencies will place a candidate with thinner experience than an employer would hire directly, because the risk is shorter. A twelve-month contract inside a real estate is credible experience and names a real employer on your resume.
• Internal transfer. The most underrated route. If you already work somewhere with an IT department, you know the business, the people and the systems, and hiring you is low risk. Volunteer for the asset inventory, the migration pilot group, the offboarding cleanup. People get moved across on the strength of exactly that.

For a first job, the lab is not a hobby, it is your evidence, and the difference between a lab that works and one that does not is whether it contains a real environment rather than a single virtual machine. A credible one: a hypervisor on a used workstation (Proxmox VE is free, and the Hyper-V role comes with Windows Pro now that the standalone free Hyper-V Server is gone), a domain controller with DNS and DHCP and a second one so you can break the first on purpose, a Windows client joined to the domain and managed by Group Policy, a Linux host running something real, a backup target, and at least one restore you performed and documented. Add a cloud tenant, with one caveat worth knowing before you plan around it: the Microsoft 365 Developer Program now requires an eligible Visual Studio subscription, so a trial tenant or a single paid Business Basic licence is the reliable route to a tenant of your own. Then write the lab up as a runbook with the commands and the screenshots, and put the scripts in a public repository. In an interview, I broke replication between the two domain controllers deliberately and here is how I found it, is worth more than any certification on the page.

Volunteer IT for a nonprofit, a church, a youth sports league or a small charity is the most credible non-employment experience in this field, for one reason: it is a real environment with real users who complain. It is also the only kind of unpaid work worth doing here, and it should be time-boxed.

Where this job leads, and what each exit needs from you now. Security engineering or governance, risk and compliance is the shortest hop, because identity, endpoint and logging experience is exactly what those teams lack; start by owning the MFA rollout and the audit evidence. Identity and access management is the most direct specialisation and is hiring well; own joiner-mover-leaver and Conditional Access. Cloud engineering needs infrastructure as code in a repository, not console clicks, so build something with Terraform, OpenTofu or Bicep and keep it in version control. Platform engineering and SRE need a product-facing story with service objectives and code review, which is the biggest leap from here. IT management needs budget, vendor and people evidence, so volunteer to run the renewal and the vendor review. Pre-sales and solutions engineering pays well and wants the half of you that can explain things to a department head.

The dead end to avoid is specific and common: being the only person who understands an undocumented estate, with no project you could describe to a stranger, for five years. That person is hard to promote and hard to hire, and they are usually the last to notice. The exit is always the same: document the estate, then take the migration.

What a screen is looking for

These are the terms that a resume screen, human or automated, is matching against for this role. Use the ones that are true of you, in the words the posting uses.

• Systems administrator
• Sysadmin
• Systems engineer
• Infrastructure engineer
• IT operations
• Active Directory
• Entra ID
• Azure AD
• Group Policy
• GPO
• Domain controller
• Kerberos
• LDAP
• DNS
• DHCP
• PKI
• Certificate services
• Certificate lifecycle
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Windows 11 migration
• Windows 10 end of support
• Extended Security Updates
• Exchange Server
• Exchange Online
• Exchange Server Subscription Edition
• Microsoft 365
• Microsoft 365 administration
• SharePoint Online
• OneDrive for Business
• Microsoft Teams administration
• Microsoft Purview
• Sensitivity labels
• Data loss prevention
• Microsoft 365 Copilot
• Copilot readiness
• Restricted Content Discovery
• Microsoft Intune
• Configuration Manager
• SCCM
• Co-management
• Autopilot
• Endpoint management
• MDM
• Jamf
• Mac fleet management
• Okta
• SSO
• SAML
• OAuth
• SCIM
• Conditional Access
• Multi-factor authentication
• MFA enforcement
• Privileged access management
• Least privilege
• Joiner mover leaver
• Identity and access management
• PowerShell
• PowerShell scripting
• Bash
• Python scripting
• Ansible
• Terraform
• OpenTofu
• Bicep
• Infrastructure as code
• Configuration management
• Git
• Version control
• VMware vSphere
• ESXi
• vCenter
• Hyper-V
• Proxmox VE
• Nutanix
• Virtualisation
• P2V migration
• Hypervisor migration
• Linux administration
• Red Hat Enterprise Linux
• RHEL
• Ubuntu Server
• systemd
• Docker
• Kubernetes
• Containers
• AWS
• Azure
• Azure administration
• Cloud migration
• Veeam
• Backup and recovery
• Immutable backup
• Air-gapped backup
• 3-2-1-1-0
• Disaster recovery
• RTO
• RPO
• Restore testing
• Business continuity
• Patch management
• WSUS
• Patch compliance
• Vulnerability remediation
• Microsoft Defender for Endpoint
• Endpoint detection and response
• EDR
• SIEM
• Microsoft Sentinel
• Monitoring
• Zabbix
• PRTG
• Datadog
• Grafana
• Alerting
• Capacity planning
• ITIL
• Change management
• Change control
• Incident response
• Root cause analysis
• Problem management
• ServiceNow
• Jira Service Management
• Freshservice
• Ticketing system
• ITSM
• Runbook
• Documentation
• Asset inventory
• Licence management
• Vendor management
• SLA
• On-call rotation
• Escalation
• NTFS permissions
• File share permissions
• DFS
• Storage administration
• SAN
• NAS
• RAID
• Firewall administration
• VPN
• VLAN
• Network troubleshooting
• SPF
• DKIM
• DMARC
• Mail flow
• Email security
• Phishing response
• CIS Benchmarks
• STIG
• NIST SP 800-171
• CMMC
• SOC 2
• HIPAA
• PCI DSS
• Cyber insurance questionnaire
• Security hardening
• Audit evidence
• CompTIA A+
• CompTIA Network+
• CompTIA Security+
• DoD 8140
• DoDM 8140.03
• AZ-104
• MS-102
• SC-300
• MD-102
• AZ-800
• RHCSA
• LFCS
• CKA
• AWS SysOps Administrator
• VMware certified professional
• ConnectWise
• Datto
• NinjaOne
• Kaseya
• RMM
• Managed service provider
• Help desk escalation
• Tier 2 support
• Tier 3 support
• Security clearance
• Public trust
• GS 2210

Mistakes that cost people this job

Questions people ask