The Systems Administrator (IAM Engineer) position is a critical role within the Second Sight IT organization and an invaluable resource for Second Sight professionals. This position owns the lifecycle, security, and governance of user identities and access across Second Sight's Microsoft Entra ID-centered environment, ensuring that the right people have the right access to the right systems at the right time. The right candidate is a highly motivated problem solver who pairs deep identity and access management (IAM) expertise with above average white glove customer service, and who will work closely with the Security Team and the IT Services team to support our customer base (aka Second Sight) in a Mac and Cloud Service supported environment.
Key Responsibilities:
Identity Lifecycle Management
- Own the end-to-end joiner, mover, and leaver process for employees and contractors in Microsoft Entra ID, including account provisioning, role and group changes, and timely revocation of access at offboarding.
- Administer Microsoft Entra ID users, security, and Microsoft 365 groups (including dynamic groups), guest (B2B) accounts, and device registrations, as well as maintain standards for naming, attributes, and group-based licensing.
- Manage user access across the software systems used within Second Sight, including onboarding applications to single sign-on (SAML/OIDC), configuring enterprise applications and app registrations, and automated user provisioning (SCIM) where supported.
- Coordinate with Governance, Risk and Compliance (GRC), HR, department managers, and application owners to define role-based access models and approve, fulfill, and document access requests.
Authentication and Access Control
- Design, implement, and maintain Conditional Access policies, including device compliance, location, and risk-based controls, using documented testing and change management.
- Manage multi-factor and passwordless authentication (e.g., Microsoft Authenticator, FIDO2 security keys, passkeys, Temporary Access Pass), self-service password reset, and authentication method policies.
- Administer privileged access using least-privilege, role-based access control, including Privileged Identity Management (PIM) just-in-time elevation, separate administrative accounts, and emergency (break-glass) account procedures.
- Monitor sign-in and audit logs and identity risk signals (e.g., risky sign-ins and users) and, with the Security Operations Team, investigate and remediate suspicious activity and identity-related security findings.
Access Governance, Audit, and Compliance
- Plan and perform periodic access reviews and recertifications for users, groups, applications, and privileged roles; follow up on remediation and retain evidence for auditors.
- Perform regular audits to ensure compliance with IT and access policies, identify excessive or orphaned access and stale accounts, and identify potential security risks.
- Support internal and external audits and client security assessments by providing identity and access evidence, documentation, and reporting.
- Develop and maintain IAM standards, procedures, runbooks, and metrics; develop and deliver employee training on secure authentication and access practices.
Automation and Integration
- Automate identity lifecycle, reporting, and routine administration tasks using PowerShell, Microsoft Graph, Entra lifecycle workflows, and similar tools.
- Integrate Entra ID with HR sources, Help Desk, and ticketing software (e.g., Jira), endpoint management (Jamf, Intune), and SaaS applications to streamline access requests and approvals.
- Research and evaluate new identity, authentication, and access governance capabilities and recommend improvements.
Endpoint and Systems Support
- Manage endpoints (MacBooks) that are returned to the DC office as part of the off-boarding process. This will include inventorying and preparing for shipment to other endpoint specialists.
- Assist with the onboarding and offboarding process for MacOS users, including setting up new devices and revoking access when necessary.
- Provide Tier 2/3 support for identity and access incidents, such as account lockouts, MFA enrollment and recovery, and application access issues.
- Support Mac devices in coordination with identity controls, including device compliance, FileVault, and Jamf/Intune integration with Entra ID Conditional Access and single sign-on for macOS users.
- The following items are as time is available:
- Deploy, maintain, and troubleshoot MacBooks and mobile devices (iOS, tablets, and smartphones), both remotely and onsite; manage standardized workstation software configurations and updates and patches for MacOS and installed software with minimal disruption to end users.
- Troubleshoot general MacOS issues and interactions with Microsoft 365, centralized management software (e.g., Jamf, FileVault), and endpoint security software (e.g., Defender); help Second Sight team members with questions regarding commercial off the shelf (COTS) software applications (Office 365 tools, Adobe, Intune, etc.).
Collaboration and Projects
- Work as part of a team, sharing duties with other IT personnel throughout Second Sight Solutions, and coordinate project actions with the IT Services Manager, System Administrators, vendors and technical representatives, and internal and external clients.
- Coordinate IT project teams, and schedule and organize upgrades, migrations, and maintenance.
- Additional tasks may be required as directed by the IT Services Manager.
Qualifications:
- Minimum 3-4 years of IT experience working in a similar capacity, including at least 2-3 years of hands-on identity and access management experience in a Microsoft Entra ID and Microsoft 365 environment.
- Strong hands-on experience administering Microsoft Entra ID, including Conditional Access, MFA and passwordless authentication, enterprise applications and app registrations, single sign-on, group-based licensing, Privileged Identity Management, and access reviews.
- Solid understanding of IAM concepts and principles, including least privilege, role-based access control, segregation of duties, joiner/mover/leaver lifecycle management, Zero Trust, and authentication and federation standards (SAML, OAuth 2.0, OpenID Connect, SCIM).
- Proficiency with PowerShell and the Microsoft Graph API (or comparable scripting) to automate identity administration, reporting, and auditing tasks.
- Experience supporting access reviews, audits, and compliance or client security assessments, with the ability to produce clear evidence and documentation.
- The candidate should have hands-on experience with device management software such as Microsoft Intune (required) and Jamf (nice to have). They should be able to deploy, configure, and manage Apple devices and BYOD phones at scale, and understand IT security principles, privacy practices, and how they apply to Apple environments, with familiarity with encryption, multi-factor authentication, and secure device management.
- IT Service Management ticketing experience (e.g., Jira).
- Strong knowledge of technology, hardware and software in a professional services environment (e.g., working knowledge of MacOS, desktop and network security issues, software functionality and deployment, in addition to Microsoft Office 365).
- VIP customer satisfaction focus. Great customer service and interpersonal skills. Excellent and effective communication skills, including speaking, writing and active listening. Must have a positive, professional attitude, and the integrity and discretion to handle privileged access and sensitive personal and client data.
- Ability to solve complex problems by gathering facts and applying detailed troubleshooting techniques. This position requires keen attention to detail and excellent critical thinking skills.
- Good organization, time management and prioritization. Ability to multitask and prioritize workload along with project assignments.
- Experience in managing IT projects, including rollouts of new hardware and software, system upgrades, and migrations.
- General working knowledge of basic networking (TCP/IP, DNS, Routing, Sub-netting), anti-virus, backup, and remote access technologies.
- Position will be based in Washington DC, but IT personnel are required to support clients in all Second Sight locations globally, including personnel and independent contractors working remotely. Partial remote work will be supported, but in office participation will be expected at least 3 days per week.
- IT personnel may be required to travel for short periods of time. Trips will sometimes extend to 5 working days and could on rare occasions extend beyond 5 business days. All travel expenses will be reimbursed.
- On-call and overtime will be required with this position.
- Core Support hours for all Second Sight offices are from 8:00am-8:00pm local. This shift will be between those hours. Coverage over this time will be supported by the entire team in tandem to ensure best support available.
- This description indicates the general level and nature of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of employees assigned to this job.
Preferred:
- Microsoft Certified: Identity and Access Administrator Associate (SC-300) or equivalent Microsoft security certification.
- CompTIA Security+ or similar security certification.
- Apple Certified Support Professional (ACSP), Apple Certified Mac Technician (ACMT), or similar credentials that validate expertise in Apple technologies is desirable.
- ITIL 4 Foundation certification
- CompTIA A+ certification
Candidate must be able to submit verification of his/her legal right to work in the United States, without company sponsorship.
Hybrid role out of our Washington, DC office (2-3 days/week)
Salary range: $115,000 - $125,000
