Senior IT Engineer

Location: Chicago (Hybrid)

About Nara

Nara is an AI-native benefits administrator (TPA) fixing healthcare benefits by designing and administering personalized, cost-effective health plans for employers, employees, and their families. Our mission is to rebuild health care around people, not the system. We're working toward a future where coverage and care are affordable, accessible, and understandable. To get there, we're rebuilding the system from the ground up, using new data, tools, and technology in service of human judgment, not in place of it. When we succeed, people get the right care, at an optimal price, without the friction.

The Role

We are hiring our first dedicated IT engineer, reporting to the VP of Engineering. You will own identity, devices, and the SaaS environment as our company rapidly scales, and you will own the operational side of the compliance program that depends on them.

This is a hands-on senior individual contributor role. You will not have direct reports on day one, but as the company grows, we expect this function to grow with it, and we would want the person in this seat to shape and eventually staff it.

Two things will define your first year. The first is consolidating a second IT stack onto ours, so that every employee sits in one directory, on one managed device fleet, under one set of controls. The second is turning onboarding, offboarding, and access management into automated, evidence-producing workflows rather than checklists someone remembers to run.

This role sits in our corporate identity and workplace environment. You will have access to collaboration and SaaS tools that may contain protected health information, which means background check, HIPAA training, and minimum-necessary access apply.

Key Responsibilities

Identity, Devices & Systems (40%)

• Own our cloud directory as the source of truth for identity: groups, roles, SSO, SCIM provisioning, MFA, and conditional access
• Own the managed device fleet across macOS and Windows: enrollment, configuration profiles, patch and OS update enforcement, disk encryption and key escrow, and endpoint protection
• Consolidate a second IT stack onto our standard, bringing every user, device, and application under one directory and one set of controls
• Build and maintain automated joiner, mover, and leaver workflows driven by our HRIS, so that access follows role changes without manual intervention
• Administer the SaaS environment end-to-end: app onboarding, SSO integration, license management, offboarding, and shadow IT discovery
• Write and maintain the scripts and automations that make the above repeatable, against directory, MDM, and SaaS APIs
• Own office network and workplace technology, and manage third-party IT contractors, including the scoping and revocation of their access

Security & Compliance Operations (30%)

• Own day-to-day security operations at the identity, endpoint, and SaaS layer: EDR alert triage and response, suspicious login and compromised account response, MFA resets, session revocation, and phishing and email security
• Run quarterly user access reviews across identity and SaaS, track required changes to completion, and produce the evidence
• Meet our deprovisioning SLA on every departure, with documentation that stands up to sampling
• Own compliance evidence for people, device, and SaaS controls, and serve as a technical point of contact during SOC 2 Type 2 fieldwork
• Administer security awareness and HIPAA training, and track completion at hire and annually
• Run vendor security reviews for the tools and contractors in your scope
• Participate in incident response under the direction of our HIPAA Security Official, and lead response for identity, endpoint, and SaaS incidents

End-User Support & Enablement (30%)

• Own the support queue for a growing, largely non-technical team, with a mandate to shrink it through automation, self-service, and documentation
• Build an onboarding experience where a new teammate has their laptop, accounts, and access ready on day one
• Write the runbooks, how-to guides, and internal documentation that let people solve problems without filing a ticket
• Act as the escalation point for teammates at all of our locations, with occasional travel to support them in person

Requirements

• 5+ years in IT engineering, systems administration, or IT and security operations, or equivalent demonstrated experience
• Production ownership of a cloud identity provider (JumpCloud, Okta, Entra ID, or equivalent), including group design, SAML and SCIM application integration, and MFA policy
• Hands-on MDM experience across both macOS and Windows at fleet scale, including enrollment, configuration management, patching, and disk encryption
• Scripting that you have actually run in production (PowerShell, Bash, Python, or equivalent) against identity, MDM, and SaaS APIs to automate lifecycle and reporting work
• Direct experience owning evidence for a SOC 2 Type 2 or comparable audit: access reviews, onboarding and offboarding records, device compliance, and auditor requests
• Experience administering an HRIS-driven user lifecycle, or a clear grasp of why HRIS should drive it
• Strong written communication: runbooks, policies, audit responses, and documentation a non-technical teammate can follow
• Genuine comfort supporting non-technical users with patience and good judgment about urgency
• Authorized to work in the United States; we are unable to provide visa sponsorship for this role
• Chicago-based and comfortable with a hybrid schedule

Nice to Have

• Experience bringing a second company's users, devices, and applications onto a single stack
• Healthcare, HIPAA, or other regulated-industry experience
• Experience with compliance automation platforms such as Vanta or Drata
• Hands-on work with EDR tooling, including policy tuning and alert triage
• Google Workspace administration at the super admin level
• Experience replacing an all-in-one platform with best-of-breed tools, and living with the integration work that follows
• Prior experience at an early-stage startup, where the IT function was whatever you built
• Relevant certifications (CISSP, CISM, Security+, or vendor certifications in identity or endpoint management)
• Experience standing up a help desk function or managing an MSP relationship

Technical Foundation

• Google Workspace for identity management
• Bolto for HRIS
• JumpCloud for identity and device management
• SentinelOne for endpoint protection
• Vanta for compliance automation
• Slack and Notion
• We do not expect familiarity with all of it; we care far more that you have run an identity-driven environment somewhere than that you have run ours

What We're Looking For

We value how you think and approach problems as much as what you've done.

Ownership Mentality. When you take on something, you own it end-to-end until it's done, not just until it's someone else's turn. If you spot a friction point, you fix it rather than flag it and move on. An access review is not done when the spreadsheet is sent; it is done when every flagged account has been changed and the change is documented.

Learning Velocity. You teach yourself what you need to know quickly, digging into documentation and testing rather than waiting to be shown. A platform you have never administered is a week of reading and a test tenant, not a blocker.

Systems Awareness. You see how your work connects to everything around it, and you build with the full lifecycle in mind, not just the task in front of you. You do not grant one-off access; you ask which group should have carried it, and you fix the group.

Clarity in Communication. You make complex things simple for whoever is listening, translating technical detail into plain language and vague asks into concrete requirements. You can write one document that answers an auditor's question and tells a new hire what to click.

Bias for Action. You move with urgency on what you control and don't wait for perfect information to make a decision. When you find an orphaned admin account, you disable it and write up what happened rather than adding it to next quarter's review.

Teammate Mentality. You show up for the people around you, not just your own workload, and you'd want to be in a foxhole with the people you work with. A teammate locked out before a client call gets the same urgency as any other incident, and they get it without being made to feel they caused the problem.

Benefits

• Competitive salary and equity options
• Health insurance with company subsidy
• Unlimited PTO policy
• Equipment budget for your home office and travel needs
• Regular team retreats and offsites

Interview Process

• Application Review
• Initial Call (45 minutes) with the VP of Engineering to understand your background, what you have owned, and how you approach learning
• Technical Interview (60 minutes) with the technical leadership team - a 20-minute presentation from you on a prompt we send in advance, followed by 40 minutes of questions on your reasoning and the tradeoffs you weighed
• Final Interview (45 minutes) with members of the leadership team

Nara is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.