About Grassi
After more than 40 years of business growth and industry change, Grassi has redefined what it means to be an advisor and accountant to today’s businesses and individuals. Nationally ranked as one of the largest and fastest-growing accounting firms in the nation, Grassi is a leading provider of advisory, tax, and accounting services across key sectors including construction, architecture and engineering, not-for-profit, healthcare, manufacturing and distribution, financial services, real estate, and more. Several publications have ranked us among the top accounting firms to work for, highlighting our strength in work-life balance, culture, and wellness categories.
With over 550 employees and eleven offices spanning the New York Metropolitan Area, Long Island, the Northeast, Florida, New England, Denver and an international presence in Italy, we are strategically positioned to serve clients locally and globally. In 2023, Grassi became an employee-owned company by implementing an ESOP, establishing our independence and empowering our people to drive the firm’s future success. The ESOP ensures that equity partners and all Grassi U.S. employees have the exclusive opportunity to own the firm’s stock, making them integral to the company’s future.
About the Role
We are seeking a hands-on Senior Network Engineer to design, secure, maintain, and optimize enterprise networks and Microsoft Azure environments. This role combines deep Cisco networking and security expertise with intrusion prevention and broad Azure engineering experience, serving as a senior escalation resource for complex network, security, cloud, and hybrid infrastructure issues. Disciplined change management, clear communication, documentation, and sound business judgment are essential to reliable access to business-critical applications.
This U.S.-based position reports to work in Grassi’s Jericho, NY, Park Ridge, NJ, or New York, NY office. Occasional travel is required to support new-office buildouts and resolve issues at other offices.
Key Responsibilities
- Engineer, secure, and maintain Cisco networking technologies across office, data center, and hybrid environments, including LAN, WAN, wireless, internet connectivity, routing, switching, segmentation, secure remote access, and high availability.
- Troubleshoot network and application connectivity, latency, packet loss, bandwidth, and wireless performance using packet captures, logs, and monitoring tools; lead root cause analysis and prevent recurring incidents.
- Maintain network security controls, firewall policies, secure management access, site-to-site and remote-access VPNs, certificates, and least-privilege connectivity. Review access regularly and validate approved changes.
- Administer intrusion prevention systems: maintain policies, signatures, inspection settings, and approved exceptions; tune false positives; validate detection and blocking through authorized testing; and monitor sensor health, coverage, and performance.
- Analyze network and intrusion events, integrate telemetry with centralized security monitoring, and coordinate investigation, containment, and remediation with security resources while preserving investigation records.
- Design, deploy, administer, troubleshoot, optimize, and retire Azure resources across networking, compute, storage, application hosting, and hybrid connectivity. Maintain subscriptions, resource groups, governance, access controls, naming, tagging, and cost accountability.
- Manage Azure virtual networks, routing, DNS, private and VPN connectivity, and on-premises integration; support virtual desktop environments, profiles, application delivery, capacity, and user experience.
- Administer cloud and hybrid identity, role-based access, secure authentication, privileged access, and service identities. Maintain encryption, secrets, certificates, secure administration, and cloud security controls.
- Monitor network and Azure health, performance, capacity, availability, and spending; maintain diagnostics, alerts, and dashboards and recommend improvements that balance security, resilience, performance, and cost.
- Maintain backup, restoration, high availability, and disaster recovery arrangements; document recovery procedures and test restoration and failover. Coordinate application, database, and container workload dependencies with application and data owners.
- Plan and execute upgrades, migrations, patching, hardware replacement, and remediation using approved implementation, communication, validation, and rollback plans. Assess business risk and dependencies, particularly during tax and audit deadlines.
- Run, troubleshoot, and adapt approved scripts and automation for diagnostics, configuration checks, deployments, and maintenance. Use established infrastructure-as-code templates and automation standards to improve consistency, reduce repetitive work, and identify configuration drift; collaborate on advanced automation development as needed.
- Maintain diagrams, asset and configuration inventories, configuration backups, engineering standards, runbooks, and support documentation. Protect confidential information and support security assessments, audits, remediation, and recovery exercises.
- Own engineering work and escalations through resolution and handoff; coordinate vendors, carriers, application owners, security teams, and IT leadership. Communicate business impact and recovery status clearly, escalate risks early, and mentor service desk and infrastructure colleagues.
- Research unfamiliar issues using approved technical and vendor resources. Provide calm technical leadership during outages and peak periods, and participate in after-hours maintenance and critical incident response as needed.
Qualifications & Skills:
- Required
- At least 5 years of progressive, hands-on experience spanning enterprise network engineering, network security, and Microsoft Azure, including ownership of complex production environments.
- Cisco certification or another recognized networking certification is required.
- Demonstrated experience designing, maintaining, securing, and troubleshooting Cisco networking technologies, with strong networking fundamentals, secure connectivity, segmentation, high availability, and performance diagnostics.
- Hands-on intrusion prevention experience, including policy configuration, signature updates, event investigation, false-positive tuning, and prevention-control validation.
- Broad Azure experience across architecture, networking, compute, storage, identity and access, security, governance, monitoring, automation, backup, disaster recovery, and cost optimization, including secure on-premises integration and cross-platform troubleshooting.
- Demonstrated root cause analysis, vendor escalation, and technical documentation skills; hands-on experience executing upgrades, migrations, and configuration remediation with validation and rollback plans, and testing backup restoration and disaster recovery procedures.
- Practical ability to run, troubleshoot, and adapt approved scripts or automation for routine network and Azure administration, including diagnostic collection, configuration checks, and repeatable maintenance tasks.
- Strong communication, collaboration, service ownership, and mentoring skills, with sound judgment about business impact and confidential information.
- Ability to report to work in the Jericho, Park Ridge, or NYC office, travel occasionally for new-office buildouts and troubleshooting at other offices, and participate in after-hours maintenance and critical incident response as needed.
- Preferred
- Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent hands-on technical experience, military technical training, trade school, certifications, or comparable professional experience.
- Relevant Microsoft Azure certifications supported by recent hands-on engineering experience.
- Advanced experience developing reusable PowerShell and Azure CLI automation, implementing infrastructure as code and configuration automation, and integrating centralized logging with network and cloud monitoring.
- Experience leading large-scale cloud migrations, network modernization, and remediation programs; coordinating security assessments and technical audits; and planning cross-functional business continuity and disaster recovery exercises.
- Experience supporting accounting, tax, audit, advisory, financial services, or another regulated, deadline-driven environment.
Why Grassi?
Our firm is consistently ranked by Vault.com and the Best Places to Work group for our commitment to compensation, paid time off, work-life balance, culture and more. Some of the ways we accomplish this include:
Flexibility: Our work-life balance initiatives include generous paid time off, flexible “Dress for Your Day” dress code, telecommuting options, flex-time policies, and summer hours, enhanced by our Floating Summer Friday’s program, which allows team members three extra Fridays off during the summer months in addition to their PTO.
Company Culture: Here at Grassi we are dedicated to creating an environment for our team members that is positive, productive, and aligns with our company’s high standards of inclusivity, diversity, and equity. We work closely with our DEI Council and Grassi Women’s Council to organize events throughout the year to bring the firm together for open dialogue and awareness of global diversity issues. Through our charitable initiative, Grassi Gives Back, we proudly support organizations such as Ronald McDonald House, Toys for Tots, Autism Speaks, Long Island Cares, and many of our nonprofit clients.
Benefits Package: Competitive base compensation with eligibility for a raise and bonus each June or December based on performance metrics and level. Medical, Dental, and Vision Insurance, employer contribution to life insurance, 401(k) plan, ESOP, and client and employee referral bonus program.
ESOP Owned: The ESOP ensures that equity partners and all Grassi U.S. employees have the exclusive opportunity to own the firm’s stock, making them integral to the company’s future. Unlike many other ESOPs, Grassi’s is privately funded, with no outside investors or private equity firms involved in the plan.
CPA Incentive: Financial assistance toward the achievement of the CPA certification which includes the cost of the CPA study materials, CPA exam registration and sitting fees for all 4 parts (up to 2 x per part), plus the CPA application and licensing fees. Paid study time during work hours, additional paid time off to take your scheduled exam and a bonus paid upon passing the CPA exam.
Learning and Development: We offer Continuing Professional Education (CPE) opportunities, including both technical and soft skills training. These opportunities are available through internal courses and external programs led by well-known industry instructors, all at no cost to our employees.
Wellness Resources: Discounted gym memberships and various wellness initiatives and programs such as the CALM app that helps our team members lower stress, decrease anxiety, improve focus, and get more restful sleep.
Compensation for this role is determined based on a combination of factors, including but not limited to your relevant experience, skills, certifications, and geographic location. We strive to offer competitive, equitable pay, that reflects the value each team member brings to the organization. In addition to base salary, we offer a comprehensive benefits package that includes performance-based incentives, wellness and retirement programs, and opportunities for continuous professional development.
Salary ranges are provided to offer transparency and may vary depending on final candidate qualifications and local market conditions. Please find compensation information below for candidates residing in New York and New Jersey.
New York ranges are from $160,000 – $180,000
New Jersey ranges are from $160,000 – $180,000
Recruitment Fraud Notice: Grassi Advisory Group, Inc. and its affiliated entities (“Grassi”) will never ask candidates to pay fees, purchase equipment, or provide payment information. Legitimate recruiting communications from Grassi are sent only from an @grassiadvisors.com email address and will not be conducted via text message, WhatsApp, or other messaging apps. If you are unsure about a communication, do not respond, please verify it by calling Grassi’s main phone number listed on our official website.
