Corporate IT Security Engineer

Description

Key Responsibilities

Identity, Access & Endpoint Security

• Administer Microsoft Entra ID: users, groups, role-based access, Conditional Access, MFA, SSO application integrations, and identity lifecycle.
• Administer and secure Microsoft 365 and Azure tenant configurations, including role assignments, security baselines, and audit logging.
• Manage macOS devices in Jamf Pro: enrollment, configuration profiles, OS and application patching, disk encryption, and compliance reporting.
• Implement and maintain least-privilege access, including dedicated administrative accounts for privileged roles across Microsoft and key SaaS applications.
• Monitor identity and endpoint security alerts, triage and investigate, and escalate incidents in line with the incident response plan.

IT Operations & Automation

• Provide helpdesk support for employee IT needs, handling requests and troubleshooting day to day, and serve as the escalation point for corporate IT issues alongside the IT Manager.
• Own joiner, mover, and leaver (onboarding and offboarding) processes and automate provisioning and deprovisioning so access changes are timely, consistent, and auditable.
• Build and maintain scripts (PowerShell / Microsoft Graph, Bash/zsh, or Python) and low-code/no-code workflows (Power Automate, Logic Apps, or similar) to eliminate repetitive manual IT and compliance tasks.
• Support configuration and integration of business applications (e.g., Microsoft 365, Salesforce, Atlassian, and our finance systems).
• Document IT processes, standards, and runbooks so they can be followed and audited by others.
• Coordinate with third-party IT service providers and vendors to resolve issues on time.

Security, Risk & Compliance

• Own the day-to-day operation of technical controls for SOC 2 and GDPR, ensuring controls are designed, operating, and evidenced throughout the audit period.
• Maintain our GRC platform: keep system integrations healthy, resolve failing control tests, and automate evidence collection wherever possible.
• Coordinate audits, assessments, and auditor requests in partnership with the IT Manager.
• Run periodic user access reviews, vendor security reviews, and security control reviews; partner with DevOps on access reviews for cloud infrastructure.
• Track vulnerabilities, penetration-testing findings, and security issues through resolution with IT, DevOps, and development teams.
• Maintain security policies, the risk register, and supporting compliance documentation.
• Support security awareness training and phishing simulations, and help employees follow security best practices.

Requirements

What We're Looking For

Required

• 3-5 years of experience in IT systems administration, security engineering, or a related field, including hands-on work operating security or compliance controls.
• Hands-on administration of Microsoft Entra ID and Microsoft 365, including Conditional Access, MFA, role-based access, and SSO application integration.
• Working experience with Microsoft Azure administration and security (e.g., RBAC, Azure Policy, resource and identity security).
• Experience managing macOS devices with Jamf Pro.
• Demonstrated experience automating IT processes using scripting (PowerShell, Bash/zsh, or Python) and low-code/no-code tools (Power Automate, Logic Apps, or similar). You should be able to walk us through workflows you have built and the manual effort they removed.
• Practical experience supporting SOC 2 (Type II preferred), GDPR, or similar frameworks, including evidence collection and remediation.
• Comfortable working independently, managing competing priorities across IT operations and security work.
• Strong communication skills - able to translate technical and compliance requirements for non-technical stakeholders.
• Bachelor's degree in Information Technology, Computer Science, or a related field (or equivalent experience).

Nice to Have

• Experience with a GRC/compliance automation platform such as Drata or Vanta.
• Experience with Microsoft Intune and Microsoft Defender for Endpoint or Defender XDR.
• Familiarity with AWS identity and access management (IAM) concepts.
• Relevant certifications, such as Microsoft SC-300 (Identity and Access Administrator), SC-500 (Cloud and AI Security Engineer) or its predecessor AZ-500, Jamf Certified Tech or Admin, or CompTIA Security+.