Key Responsibilities 

Identity, Access & Endpoint Security 

• Administer Microsoft Entra ID: users, groups, role-based access, Conditional Access, MFA, SSO application integrations, and identity lifecycle. 
• Administer and secure Microsoft 365 and Azure tenant configurations, including role assignments, security baselines, and audit logging. 
• Manage macOS devices in Jamf Pro: enrollment, configuration profiles, OS and application patching, disk encryption, and compliance reporting. 
• Implement and maintain least-privilege access, including dedicated administrative accounts for privileged roles across Microsoft and key SaaS applications. 
• Monitor identity and endpoint security alerts, triage and investigate, and escalate incidents in line with the incident response plan. 

IT Operations & Automation 

• Provide helpdesk support for employee IT needs, handling requests and troubleshooting day to day, and serve as the escalation point for corporate IT issues alongside the IT Manager. 
• Own joiner, mover, and leaver (onboarding and offboarding) processes and automate provisioning and deprovisioning so access changes are timely, consistent, and auditable. 
• Build and maintain scripts (PowerShell / Microsoft Graph, Bash/zsh, or Python) and low-code/no-code workflows (Power Automate, Logic Apps, or similar) to eliminate repetitive manual IT and compliance tasks. 
• Support configuration and integration of business applications (e.g., Microsoft 365, Salesforce, Atlassian, and our finance systems). 
• Document IT processes, standards, and runbooks so they can be followed and audited by others. 
• Coordinate with third-party IT service providers and vendors to resolve issues on time. 

Security, Risk & Compliance 

• Own the day-to-day operation of technical controls for SOC 2 and GDPR, ensuring controls are designed, operating, and evidenced throughout the audit period. 
• Maintain our GRC platform: keep system integrations healthy, resolve failing control tests, and automate evidence collection wherever possible. 
• Coordinate audits, assessments, and auditor requests in partnership with the IT Manager. 
• Run periodic user access reviews, vendor security reviews, and security control reviews; partner with DevOps on access reviews for cloud infrastructure. 
• Track vulnerabilities, penetration-testing findings, and security issues through resolution with IT, DevOps, and development teams. 
• Maintain security policies, the risk register, and supporting compliance documentation. 
• Support security awareness training and phishing simulations, and help employees follow security best practices. 

What We're Looking For 

Required 

• 3–5 years of experience in IT systems administration, security engineering, or a related field, including hands-on work operating security or compliance controls. 
• Hands-on administration of Microsoft Entra ID and Microsoft 365, including Conditional Access, MFA, role-based access, and SSO application integration. 
• Working experience with Microsoft Azure administration and security (e.g., RBAC, Azure Policy, resource and identity security). 
• Experience managing macOS devices with Jamf Pro. 
• Demonstrated experience automating IT processes using scripting (PowerShell, Bash/zsh, or Python) and low-code/no-code tools (Power Automate, Logic Apps, or similar). You should be able to walk us through workflows you have built and the manual effort they removed. 
• Practical experience supporting SOC 2 (Type II preferred), GDPR, or similar frameworks, including evidence collection and remediation. 
• Comfortable working independently, managing competing priorities across IT operations and security work. 
• Strong communication skills — able to translate technical and compliance requirements for non-technical stakeholders. 
• Bachelor's degree in Information Technology, Computer Science, or a related field (or equivalent experience). 

Nice to Have 

• Experience with a GRC/compliance automation platform such as Drata or Vanta. 
• Experience with Microsoft Intune and Microsoft Defender for Endpoint or Defender XDR. 
• Familiarity with AWS identity and access management (IAM) concepts. 
• Relevant certifications, such as Microsoft SC-300 (Identity and Access Administrator), SC-500 (Cloud and AI Security Engineer) or its predecessor AZ-500, Jamf Certified Tech or Admin, or CompTIA Security+.