Senior System Administrator – Business Systems & Endpoint Operations
You'll join at an inflection point. We're transitioning off a virtual desktop environment toward managed, trusted laptops, which means the security perimeter is changing and the endpoint becomes the control point. You'll own that transition operationally while keeping our SOC 1 and SOC 2 evidence continuously audit-ready rather than assembled in a scramble each cycle.
This is a hands-on operations role reporting to the Head of IT. It suits someone who takes real ownership of the environment, communicates clearly with non-technical colleagues, and would rather prevent a problem than resolve one quickly.
- Administer the firm's core business platforms (Monday.com, Jira, and HubSpot, and others). Including user provisioning, permissions, workspace structure, integrations, and license management.
- Manage Claude access and spending controls: seat provisioning, group membership, usage limits, and cost monitoring against budget.
- Own Microsoft Intune administration for the Windows fleet and Jamf administration for Macs and iPads, covering enrollment, compliance policies, configuration profiles, application deployment, and patching.
- Build and operate the trusted laptop program: device baselines, encryption, conditional access enrollment, and lifecycle management from provisioning through decommission.
- Support the VDI-to-laptop transition operationally including imaging, migrations, user onboarding, and the exceptions that inevitably follow.
- Administer M365 and Entra identity: SSO, group management, conditional access, and license assignment. Own onboarding and offboarding execution end to end.
- Administer OneDrive and SharePoint governance: storage policies, retention, and external-sharing controls appropriate to a firm handling client data.
- Automate repetitive administrative work using PowerShell or Python to accelerate onboarding and offboarding steps, reporting, license reconciliation, and compliance evidence collection.
- Monitor security alerting across M365 Defender, Intune, and endpoint tooling. Triage with judgment, investigate events, and escalate with a clear read on severity.
- Execute ISMS automation work in Vanta and own technical evidence collection for SOC 1 and SOC 2 (access reviews, device compliance, patch records, and offboarding logs).
- Surface control gaps and access drift proactively, before they become audit findings.
- Zealous about exceptional client service and internal collaboration.
- Agile and execution-focused, with a bias toward action and impact.
- Growth-oriented and committed to professional development.
- Feedback-heavy and mentoring-rich, with a culture of continuous improvement.
- Eager to solve complex, ambiguous problems with creativity and rigor.
- Hardworking and passionate about building the future of technology-enabled consulting.
- 6+ years of experience in system administration, IT operations, or endpoint management in a business environment.
- Hands-on administration experience with Microsoft Intune and Microsoft 365/Entra, including conditional access and identity governance.
- Experience with Jamf for macOS and iPad management.
- Demonstrated experience administering SaaS business platforms (Monday.com, Jira, HubSpot, or comparable tools) and dealing with permissions models, integrations, and license governance.
- Working knowledge of OneDrive and SharePoint administration, including sharing and retention policy enforcement.
- Scripting proficiency in PowerShell or Python is sufficient to automate routine administrative work, reporting, and evidence collection.
- Experience supporting SOC 1 or SOC 2 evidence collection and control operation; familiarity with compliance automation platforms such as Vanta is a strong plus.
- Practical security monitoring experience with ability to triage alerts with judgment rather than escalating indiscriminately or not at all.
- Experience supporting a VDI-to-physical-endpoint migration or comparable environment transition is a plus.
- Strong written and verbal communication skills. You will explain technical constraints to non-technical colleagues regularly, and clarity matters.
- Background check required.