I'm a recent Computer Science graduate who started my career in desktop support at a large manufacturing company. That job gave me experience with Windows troubleshooting, hardware, basic networking, print servers, network-management tools, ticket handling, and basic Active Directory administration. I was still learning server administration, VLANs, security, cloud systems, and larger infrastructure design.
After about six months, I accepted a similar-paying position at a smaller manufacturing company closer to home. I expected another technical-support role, but the company's IT environment is in much worse shape than I realized.
The company has two manufacturing sites and a separate main office connected through wireless links and a site-to-site VPN. The network includes unmanaged switches, hubs, outdated routers, and devices connected without a clear design. Many computers are obsolete, underpowered, or improperly licensed. The ERP database is running on a desktop computer using an evaluation copy of Windows, and there does not appear to be a proper server, backup, monitoring, or disaster-recovery strategy.
The ERP environment has already been compromised twice. There are also separate databases at different locations that are manually synchronized, and I'm not convinced the process provides reliable consistency or recovery. The company website is hosted in the same general environment, with several exposed ports and what appears to be a poorly configured firewall.
I explained to the CEO that this is no longer ordinary desktop support and that the company needs an experienced infrastructure consultant or managed service provider. I recommended reviewing the network architecture, firewall rules, segmentation, remote connectivity, server setup, backups, endpoint security, licensing, access control, monitoring, documentation, and incident-response procedures.
Instead, he told me to contact the local computer-shop owner who has been maintaining the environment and said I should take responsibility, consult former coworkers, and make sure there is no data loss. I'm concerned that if the company is hacked again or the ERP data is damaged, I'll be blamed even though I'm a junior employee working alone.
I'm willing to learn, but I'm not sure whether this is a valuable opportunity or an unreasonable amount of responsibility. Should I stay and try to improve the environment, insist on outside professional help, document the risks formally, or start looking for another job?
4 Answers
Document everything immediately: the current architecture, known vulnerabilities, missing backups, licensing issues, previous incidents, and the recommendations you have already made. Put the risks and required actions in writing to management, using business consequences rather than only technical terms. Keep copies of your documentation somewhere you are authorized to store them, but do not take confidential company data with you.
Do not promise that you can prevent data loss or secure the environment alone. Ask management to approve an independent infrastructure and security assessment from a qualified MSP or consultant. Until then, prioritize verified backups, patching, removing unnecessary internet exposure, securing administrator accounts, and preserving logs. Those actions should be planned carefully rather than improvised on production systems.
If you decide to stay temporarily, treat it as a structured remediation project rather than trying to rebuild everything at once. First inventory systems and dependencies, identify who owns each application, establish tested offline or immutable backups, and document how restoration would work. Then address exposed services, unsupported operating systems, privileged accounts, patching, endpoint protection, and network segmentation in an order approved by management.
Get written approval before major changes and make sure the ERP vendor is involved in database, replication, and recovery decisions. Manually copying databases is not automatically wrong, but it needs a documented, tested process with clear ownership and a defined recovery point. Do not experiment with production data while learning.
The CEO’s response is the biggest issue here. Technical problems can often be fixed, but an owner who rejects professional help and still assigns one inexperienced employee responsibility for business continuity is unlikely to support you when something goes wrong.
Give them a concise written risk assessment and a reasonable proposal for external assistance. If they refuse, keep your communication professional and begin planning your exit. You are not running away from a challenge; you are recognizing that a company-wide infrastructure and security program needs adequate resources and accountability.
This is not a normal junior support position. You are being asked to cover desktop support, network administration, security, database reliability, disaster recovery, and infrastructure architecture without the staffing or experience those responsibilities require.
A good opportunity would include a manager, budget, mentorship, and authority to bring in specialists. If management refuses outside help while making you personally responsible for the outcome, that is a serious warning sign. Start applying elsewhere now. You can continue learning from the role, but don’t allow the company’s lack of planning to become your professional liability.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures