Read your own job posting: it is an inventory, not a role

Somewhere in the last month a company of about eighty people posted a job. It asks for someone to run the service desk, administer Microsoft 365 and Entra ID, own the firewall and the site-to-site VPN, manage endpoint protection and patching, hold the backups, act as the security contact for the customer questionnaires that keep arriving, and be the internal expert on the ERP. Five to seven years of experience. One salary, and it is a regional one.

It will not fill. It will sit for ninety days, get re-posted with the word senior added and the salary unchanged, and eventually be filled by somebody who can do about half of it well. That is not a hiring failure and the salary is not the problem either. The problem is upstream: what was posted is not a job.

How the list got that long¶

Nobody sat down and decided one person should own all of that. Each line arrived on its own, in the week it broke. The Wi-Fi went down at the second site and they fixed it, so the network became theirs. The auditor asked who owned patching and they were the only person in the room who knew, so patching became theirs. A customer sent a security questionnaire and somebody had to answer it. Every one of those decisions was locally correct and cost nothing at the time, because the person absorbing them was competent and did not complain.

What accumulates that way is invisible until it leaves. The organization has no document describing it, because the document was a person. The job posting is the first time in years that anyone has written the estate down, and it was written under time pressure by a manager reconstructing it from memory and from a calendar. That is why the list reads oddly to anyone in the field: it is not a role, it is an inventory, and it is an incomplete one.

Sort it by what each line demands¶

The list looks like one job because every item is IT. Sort it instead by what each item requires from whoever holds it, and the shape changes immediately. Four columns are enough.

Only the first row survives contact with a single hire. That is the whole finding, and it is worth stating plainly because the usual conclusion drawn from a stalled search is that the market is tight or the salary is low. Both may be true. Neither is why three of those four columns are unfillable by one person at any salary.

Why availability is structural and not a matter of effort¶

The availability row is the one people argue about, usually by pointing at the person who just left and observing that they did answer at eleven at night. They did. That is not the same as the business having an availability commitment, and the difference shows up on exactly the day it matters.

The clearest statement of this is in the incident-response literature rather than the service-desk one. NIST SP 800-61r3 (opens in a new tab) treats response as a set of defined roles with stated responsibilities and stated availability, coordinated against a plan that exists before the incident does. Every version of that guidance assumes the answer to “who is reachable, and by when” is a property of the organization. A single administrator can be heroic; they cannot be a property of the organization. The moment they are on a plane, in a hospital, or three weeks into a new job somewhere else, the commitment was never there; it was a habit, and habits do not survive the event they were being relied on for.

This is also the row that is quietly the most expensive to get wrong, because it only ever fails at the worst moment. Nothing goes wrong at four on a Tuesday afternoon that a competent person cannot handle by Wednesday. The failures that cost real money are the ones discovered at five on a Friday, on a long weekend, or at the exact hour the person holding everything is unreachable and the backup nobody had tested turns out to have been failing silently since March.

What co-managed actually means¶

The arrangement that fits the four columns is not “hire nobody and outsource it all”, and it is not the hire on their own. It is both, with the split written down: your person owns presence and relationships, an outside team owns availability, depth and continuity. The industry calls this co-managed IT, which is a bland name for the only division of labor the sorted list actually supports.

In practice that means your hire keeps the service desk, the floor, the joiners and leavers, and the standing in the building that lets them tell you what is really going on. They stop being the only person who can restore a server at two in the morning, the only person who has ever configured the firewall, and the only person who knows why the VLAN exists; because those three things are documented, monitored and covered by a team with a rota. They also stop being the person who has to say yes when a customer questionnaire asks whether the environment is monitored.

The version of this that goes wrong is the one where the split is never written down. Two parties both loosely responsible for patching is worse than one party clearly responsible for it, and the failure is silent: everything looks covered until the month it was not. If you take one operational thing from this piece, take that the split has to be a document, per system, with a name against each line.

The test that separates it from staffing¶

Plenty of firms will offer you something called co-managed while the seat is empty. The question worth asking on the first call is what happens to the arrangement on the day you make the hire. If the answer is that it winds down, you were not being offered co-managed IT. You were being offered a contractor to keep the lights on until you replace them, which is a legitimate product and a different one, and it should be priced and scoped as what it is.

A real co-managed arrangement is more valuable after the hire than before it, because the hire is who it is for. The out-of-hours cover, the specialist depth and the documentation are what make the role fillable at the salary you can actually pay: you are no longer recruiting a mythical person who is simultaneously a network engineer, a security specialist and someone happy to reset passwords. You are recruiting a good generalist with a team behind them, which is a job that exists.

Ask the second question too. When we leave, what do we hold? A firm that cannot answer that in one sentence on the first call has not thought about it, and the cost of leaving a managed arrangement is set on the day you sign it rather than the day you give notice.

What to do this week, even if you hire¶

The single highest-value action available to you right now has nothing to do with choosing a provider, and it expires. Every week between the resignation and the last day is a week in which the inventory can still be written down by the person who knows it.

1. 1.Take the posting and mark each line with which of the four columns it belongs to. Half an hour, and it changes what you are recruiting for.
2. 2.Sit with the person who is leaving and write down what is not on the list: which vendor holds which circuit, what the account with the shared password is for, what breaks every quarter, what they were about to do next and why.
3. 3.Establish who holds the keys, in whose name. Tenants, domains, licenses and circuits registered to a departing individual or a previous provider are the most common form of lock-in, and it is not a clause; it is an ownership record nobody checked.
4. 4.Test one restore. Not review the backup dashboard; restore something and open it. This is the single check most likely to return an unwelcome answer, which is why it is worth doing while somebody who knows the system is still employed.
5. 5.Only then decide the shape: hire, co-manage, or both. The decision is easy once the inventory exists, and impossible to make honestly before.

That list is, deliberately, most of what an incoming provider does in its first two weeks; the estate review, before anything is agreed. If you would rather run it yourself, run it yourself; it is worth more to you than to us and it is worth most while the outgoing person is still there to answer a question.

Where this argument stops¶

Co-managed is not the right answer everywhere, and the two cases where it is wrong are easy to name. If the honest total across all four columns really is one full-time job (a single site, sixty people, no line-of-business system anyone would call complex) then hire the person and buy nothing else; an outside team layered on top of that is overhead wearing the language of resilience. And if what the estate needs is somebody physically present most days, a remote arrangement will underserve you no matter how good the rota is, and any firm that tells you otherwise on a first call is selling rather than scoping.

Both of those are answerable in forty-five minutes, before anyone quotes anything. What is not answerable in forty-five minutes is whether one person can be four columns at once. That one has already been answered, by the posting.