Job Description

About the role

Our customers expect us to meet SOC 2, ISO 27001, GDPR, HIPAA and ISO 42001. You will be our first IT hire and will own corporate IT and IT security end-to-end for ~150 people: identity, devices, SaaS, and the IT controls auditors test. This is a builder role. You will configure, script and fix things yourself.

What you will do

• Own Google Workspace administration: org units, groups, security settings, DLP, context-aware access, email security (SPF, DKIM, DMARC).
• Run identity and access in Okta and 1Password: SSO and enforced MFA for every SaaS app (Cloudflare, Slack, GitHub, cloud consoles), role-based access, privileged access, and quarterly access reviews with evidence.
• Automate the joiner, mover and leaver process with HR, so offboarding removes all access within 24 hours.
• Manage the Mac-first fleet (plus some Windows/Linux) through MDM: enrollment, disk encryption, OS patching, screen lock, EDR, and remote wipe.
• Keep a complete asset inventory and SaaS inventory; find and remove shadow IT; manage licences and IT spend.
• Own IT vendor management and security reviews of IT tools together with the GRC Lead.
• Keep the Google Workspace, Okta, 1Password, Slack, GitHub, Cloudflare and MDM integrations healthy; keep personnel and account mapping accurate; run Vanta access reviews; and keep every identity, device and offboarding test passing as audit evidence for SOC 2, ISO 27001, ISO 27701 and HIPAA.
• Run security awareness training and phishing simulations; track completion.
• Handle IT helpdesk and onboarding; write runbooks so it scales.
• Own office and remote network security: Wi-Fi, firewall, VPN or zero-trust access, and guest isolation.
• Execute IT parts of incident response, backup and business continuity tests.
• Script repetitive work (Google Apps Script, Python, Bash, GAM, MDM APIs).

What you must have

• 7+ years in IT operations, 3+ of them at a SaaS or tech company of 100–500 people.
• Hands-on, expert-level Google Workspace admin.
• Hands-on with Okta (or a similar IdP such as JumpCloud or Entra ID): SAML, OIDC, SCIM provisioning.
• Hands-on Mac MDM (Jamf, Kandji, Mosyle or Intune for macOS), plus an EDR tool.
• Have supported at least one SOC 2 or ISO 27001 audit and produced evidence yourself, ideally through Vanta (Drata or Secureframe is acceptable if you can ramp on Vanta in the first month).
• Working knowledge of AWS, GCP or Azure IAM, enough to manage console access and SSO into cloud accounts.
• Scripting in at least one of Python, Bash, or Apps Script.
• Clear writing: you document what you build.

Nice to have

• Has used the Vanta agent, Vanta access reviews or Vanta personnel onboarding/offboarding workflows.
• Certifications: Google Workspace Administrator, Jamf 200/300, CompTIA Security+, ISO 27001 Lead Implementer.
• Experience with zero-trust access (Cloudflare, Tailscale, Zscaler) and SaaS security posture tools.