Job Description:
Senior IT Engineer
Own identity end to end: Okta as the IdP, SAML/OIDC app federation, SCIM, birthright access and push groups, Okta Workflows, and the lifecycle that flows from our HRIS into every downstream system.
Administer Google Workspace across several domains and entities: organizational units, aliases, groups and routing rules, license reclamation automation, billing reconciliation ahead of renewals, and email delivery troubleshooting behind an email security gateway.
Run device management for a mostly macOS fleet: Apple Business Manager with zero-touch enrollment, MDM blueprints and OS version control, annual push certificate renewals, EDR, and Cloudflare Zero Trust device verification.
Maintain and extend our automation fleet: the Cloudflare Worker for non-SCIM provisioning (when a new app joins the stack, you write the handler), Okta Workflows, config-as-code group syncs into PagerDuty and Slack, and low-code automations for things like Slack channel governance. LLM coding tools are how we work on this, and you'll be expected to use them well.
Keep our AI support agents effective by maintaining the SOP library they draw on and keeping ticket records accurate, since completed tickets are the dataset we mine to decide what gets automated next. The goal is Tier-1 staying self-service and Tier-2 access requests moving the same way.
Handle hardware logistics for a distributed team: procurement through our warehouse vendor, automated retrieval kits where they exist, and hands-on international shipping where they don't, including customs invoices and lithium battery declarations. Repairs go through AppleCare rather than ad hoc replacement, and asset records live in an API-synced inventory system you'll keep accurate through every checkout, return, and redeployment.
Administer the collaboration suite at the org level: Slack workspace and retention administration, Notion enterprise settings including SCIM and legal holds, and the master and service accounts for our smaller legal entities.
Track and reduce SaaS spend: license audits, seat management before grants rather than after, cutting tools we don't need, and making build-versus-buy calls — we lean toward building small things in-house when an LLM and an afternoon can replace a vendor contract.
Job Requirements:
Several years of IT engineering experience, including time as the senior or sole owner of a company's IT environment rather than one seat on a large team.
Deep, hands-on Okta experience: integrating apps over SAML and OIDC, SCIM provisioning, push groups, Okta Workflows, and lifecycle management driven from an HRIS.
Google Workspace administration at super-admin level, ideally across multiple domains or entities, including the unglamorous parts: routing rules, email log forensics, and group permission edge cases.
Real MDM experience (Kandji or similar) plus Apple Business Manager, and familiarity with endpoint security tooling.
The ability to read, modify, and ship changes to small production codebases — TypeScript, in our case — using LLM coding tools. You don't need to be a software engineer, but \"I'll automate it\" has to be your honest first instinct.
A security and compliance mindset: offboarding that actually removes access, credentials and recovery flows handled by the book, requests only actioned against an official ticket, and the judgment to not touch retention settings or legal holds without approval.
Comfort operating alone: prioritizing your own queue, saying no to low-value interrupts, and measuring where your time goes so you can automate the repeat offenders. Some weeks that queue includes FedEx customs forms; you handle those with the same care as the identity work.
Nice to have: Cloudflare Zero Trust experience, global remote hardware logistics, or a background in crypto or iGaming.
Benefits:
/
