I'm leaving for a destination I still don't know
Thought some folk might find this interesting.
1: Don't run it like D&D, there is no real "Challenge rating."
That doesn't mean send players on runs that will brutalize them because "realistically" the opposition will be super tough, because Johnson isn't going to send runners on shit they likely will fail. Untested teams generally get scoped out with milkruns. On the same note, don't have the cops be retards who stand face to face with a clearly drugged up, augmented troll. They are going to run like hell, call for backup, use cover, and use thermal smoke to block line of sight. Likewise, they are not omniscient. If the players are not obviously there don't have em rush them. For examle, in a firefight you don't snipe the decker sitting on the ground in the other room just because you have LOS, because they probably arn't looking at him. If a player pops smoke or suddenly moves to the second floor, let them have their ambush, it makes shadowrun more interesting. Likewise, don't ask for sneaking rolls unless someone specifically thinks someone may be there and is listening for trouble or if they are in someone's face. Even a giant troll can go unnoticed if he is walking down a totally empty hallway during a low alert, this isn't D&D where everyone apparently sings while they walk if they botch a sneak check. Real life is noisy.
2: Don't fall into the trap of making runs super complicated.
Corps don't blow their entire operating budget on security. They won't have 50 turrets in the building. They will have ONE turret in the building, between where the wageslaves work and the high security areas. Don't just think security, think practicality. Does a corp really want to give every single wageslave an FOF enabled badge? Is it worth a glitch accidently causing the thing to fire.
3: FOR THE LOVE OF GOD, DO NOT HAVE THE JOHNSON BETRAY THE RUNNERS UNTIL YOU ARE READY FOR THE RUNNERS TO NEVER USE A JOHNSON AGAIN.
If you betray the runners they will never trust again, which is game cancer.
4: Try to remember the setting is about runners making runs, suceeding, and getting away.
If you come up with an idea on why they couldn't do this, it has already been handwaved away. At the most basic level, the mark almost never tries to go after the runners unless they make themselves a target. Sure, a rapid response team member may have been shot, and they damaged some propery, but the subsidiary branch is already in hot water with HQ for letting them get through and sure as hell won't get away with calling in even MORE money to get petty revenge that in no way will help them. They know the runner passed off the info or target. Anything destroyed or assassinated is gone. Revenge is just more red numbers in the ledger. The only exception is if the runners do something stupid, like hold onto something VALUABLE (Taking a few handguns or some electronics from a supply closet is ok, holding onto a prototype laser is dumb) because if the corp suspects it was a grab mission they will be searching for the goods. If they plug the security guard (READ: Not a member of a rapid response team) while he was napping in front of donuts the wageslaves who bought him said donuts will be said if no one looks for the murderers.
5: Don't enforce weight limits, but make sure the movement of gear is an issue.
Always ask what the runners have on their person when the run starts, and what they do with other gear they take. Take a page from Payday 2, it makes the run more fun if they need to figure out how to smuggle a giant drill in to bust a vault open.
6: Remember in 5e, the hacker is mostly going to be interacting with meatspace rather than "Hack targets" and almost every common item in the world is wireless.
So if the hacker asks "What can I hack" you should respond with "Anything." Be liberal with what they can do, as hackers are a bit meh right now if they operate purely in cyberspace.
7: Allow the runs to sometimes be easy.
Honestly a run should be a single session and you want to encourage your players to be a bit clever. If they come up with something genuinely smart then the run should be genuinely easy.
8: Remember the Johnson will hire runners who can complete the mission.
They overtly DONT want the runners to be challenged. If the team would have a nightmare of a time facing down cyber-security then the Johnson would never hire them on a run to steal data from a server unless they knew the runners could just steal the server itself.
9: Leave minor details of the world that could serve as plot threads around.
If a player takes an interest in ANYTHING and decides to poke into it further, make it a thing. Even if it was never going to be a thing in the first place, turn it into something big they can take advantage of. It helps you out a ton if the players are so invested in the world they actively create runs for you.
10: Always make sure the run has an angle.
The Johnson isn't looking to fuck the runners, but he is fucking someone. Part way through the campaign, after everyone is comfortable, throw a run with a big unforeseen affect on the world. Team hacks a mainframe and leaves a back door? Have it be a big deal a week later that during a stock crash on the server they hacked allowed Lofwyr to buy out a huge chunk of Atzy manufacturing, and now Atzy runs are super dangerous because their forces are much more angry and concentrated. They kidnap a dude? Turns out to be a researcher who makes some insane implant for security folk. This is the wakeup call for the runners to start being political, and has the same *WHAM* factor a Johnson betrayal does without having the absolutely terrible effects on your game that an actual backstabbing does. After this point the runners start wanting to cause change and that is fantastic.
To be fair, you shouldn't be setting out encounters and combat situations for your PCs, this isn't DnD. You should be creating a realistic situation for what they're doing (eg. infiltrating a gang hideout? Place will be packed of gangers. Getting into a corporate building at crack of dawn? Maybe a security team of 5-10). It's the PC's decision whether to go mirrorshades and avoid them, or to go pink mohawk and take them out, considering their situation, task and the number of enemies. There's always the option to run from a firefight too, so it's really they're fault if they get stuck into things and die for going full gung-ho when they can't hack it.
You're not making a combat encounter for them; they're finding people in the world who happen to be willing and capable of fighting back if the PCs start things. How well they fight back isn't level-scaled or shit like that; it's just what they come across.
Ain't no level appropriate encounters here. Some places will have combat as simply out of the question. Other places will be easy to knock over.