IT Operations Manager

Responsibilities

• Consolidate corporate identity behind a single identity provider, including application onboarding, automated provisioning, deprovisioning, and lifecycle rules.
• Stand up endpoint management across the fleet; select and deploy the tool and create device and acceptable-use policies.
• Build and instrument joiner, mover, and leaver processes with timing, audit trails, credential revocation, and hardware return.
• Establish recurring access reviews that produce audit-ready evidence.
• Stand up and document a narrowly scoped enclave with separate identity, managed devices, controlled storage, and a defined boundary.
• Create a complete SaaS inventory covering owners, renewal dates, administrators, and data posture.
• Separate privileged access from standard access and integrate identity and access evidence into the compliance program.
• Prepare the environment for certificate- and smart-card-based authentication.
• Write runbooks that allow the program to operate after the engagement ends.

Deliverables

Weeks 1–4

• Inventory of devices, applications, and accounts mapped to named employees and reconciled against employment status.
• Completion of the identity-provider rollout across remaining applications.
• Written joiner, mover, and leaver process with timed and evidenced access revocation.

Weeks 5–12

• Endpoint management selected, purchased, and deployed across the fleet.
• Device and acceptable-use policy supporting evidence of contractually required software restrictions.
• Quarterly access review established in an assessor-acceptable format.
• End-to-end automated offboarding, including credential and physical-asset return.
• Rationalized SaaS estate inventory.

Months 3–6

• Documented separation of privileged and standard access.
• Scheduled identity and access evidence for the compliance program.
• Scoped enclave stood up and documented with a defined user list and durable boundary.
• Readiness for certificate and smart-card authentication.
• Operational runbooks.

Requirements

• Experience administering a modern identity provider such as Okta, Microsoft Entra ID, or JumpCloud, including application onboarding, SCIM provisioning, and lifecycle rules.
• Experience deploying endpoint management from zero across a real fleet using Jamf, Kandji, Hexnode, Intune, or similar.
• Experience pairing endpoint management with an EDR tool such as CrowdStrike or Huntress.
• Experience building joiner, mover, and leaver processes that produce audit trails.
• Experience running auditor-accepted access reviews.
• Fluency in cloud-first, mostly macOS environments with Google Workspace, password managers, AWS console access, and SSO.
• Ability to write clear, usable runbooks.
• Ability to work independently as the only IT professional, with support from an engineering team.
• Must be a US person.

Nice-to-Haves

• Experience supporting SOC 2, FedRAMP, or CMMC from the IT side.
• Knowledge of certificate and smart-card authentication, PIV, CAC, and government PKI.
• Experience implementing device, software, or account restrictions required by government contracts.
• Managed service provider experience.
• Prior contract-engagement experience delivering comparable IT programs.

Scope

• Ownership covers corporate identity and corporate devices, not product engineering or government hosting environments.
• Security architecture decisions remain with the engineering lead; this role implements and operates the resulting systems.

Compensation and Benefits

• ATS-listed salary range: $156,000–$228,800.
• Medical, dental, and vision coverage are fully covered for employees and dependents, including Oxford/United Gold and Platinum PPO plans, Guardian PPO dental, and Beam vision.
• Additional benefits include $100,000 in fully paid [benefit details truncated in source].