Your role:The Enclave Systems & Support Administrator designs, builds, hardens, and operates the technical enclave - configuring identity, endpoints, data-protection controls, and FIPS-validated cryptography, and running change management - while also delivering tier-1 through tier-3 support: provisioning endpoints, issuing and tracking FIDO2 security keys, resetting credentials under least-privilege scope, and onboarding/training end users through migration and steady-state operations.
Architecture, Build & Change Management- Administer Google Workspace Enterprise Plus: Cloud Identity, OU design, custom admin roles, DLP, Drive labels/IRM, trust rules, and mail compliance.
- Build and operate ChromeOS / Chrome Enterprise endpoints and Amazon WorkSpaces (AWS GovCloud) Windows VDI.
- Configure SAML SSO with FIDO2 phishing-resistant authentication and Context-Aware Access policies.
- Establish and maintain hardened configuration baselines; enforce FIPS-mode cryptography across data states.
- Run change management: document, test, and approve configuration changes against the baseline and SSP.
- Develop scripting / automation for provisioning, configuration, and reporting; maintain backup and restore.
- Produce configuration evidence for control assessments and the C3PAO / KPMG reviews.
Front-Line Support & Access Hygiene- Provide tier-1 through tier-3 service desk support, including the password / MFA reset function (least privilege, fully logged).
- Provision and manage endpoints and MDM for Chromebook / Chrome Enterprise devices.
- Issue, inventory, and track FIDO2 security keys (two per user) and manage lifecycle / replacement.
- Lead user onboarding, joiner-mover-leaver actions, and migration of users and data into the enclave.
- Deliver end-user security awareness and CUI-handling training sessions.
- Maintain security hygiene: patch verification, asset tracking, and ticket documentation.
- Escalate significant security events to the ISSO & Security Operations Lead per the incident-response runbooks.
What you bring to the role:- 7+ years of experience with 5+ years administering Google Workspace Enterprise Plus (or equivalent) at scale, including direct end-user / service-desk support experience.
- Bachelor's degree or higher in cyber security, computer science/engineering, management of information systems or similar degrees.
- Hands-on experience with AWS (GovCloud preferred), Amazon WorkSpaces / VDI, and Chrome Enterprise - both administration and provisioning/support.
- Strong identity background: SAML SSO, FIDO2/WebAuthn, conditional/context-aware access, and MFA / hardware-key lifecycle management.
- Configuration-baseline, hardening, and change-management discipline; scripting/automation skills.
- Backup/restore and operational resilience experience.
- Strong customer-service skills and disciplined ticket / asset documentation practice.
Preferred Certifications and Qualifications- Google Workspace Administrator certification.
- AWS SysOps Administrator or AWS Security Specialty (helpful).
- CompTIA Security+ and/or CompTIA A+.
Citizenship, Screening and Trust- U.S. citizenship is required (CUI access and Security Protection function).
- Must pass Ingram Micro background screening and complete CUI handling, insider-threat, and incident-handling training before access.
- Subject to least-privilege access controls and periodic access recertification; the dual compliance-owner / operator scope of this role is independently validated via the third-party KPMG / C3PAO assessment.
Work Model & ConditionsFull-time exempt role based in the U.S.. Occasional travel for the C3PAO assessment and audit activities. Standard business hours with a scheduled on-call rotation for after-hours Sev1/2 incident escalation; extended hours possible during active incidents or the C3PAO assessment window.
The typical base pay range for this role across the U.S. is USD $133,400.00 - $226,800.00 per year.
The ranges above reflect the potential annual base pay across the U.S. for all roles; the applicable base pay range will depend on the candidate's primary work location, pay grade, and variable compensation plan. Individual base pay within each range depends on various factors, in addition to primary work location, such as complexity and responsibility of role, job duties/requirements, and relevant experience and skills. Base pay ranges are reviewed and typically updated each year. Offers are made within the base pay range applicable at the time of hire. New hires starting base pay generally falls in the bottom half (between the minimum and midpoint) of a pay range.
At Ingram Micro certain roles are eligible for additional rewards, including merit increases, annual bonus or sales incentives and long-term incentives. These awards are allocated based on position level and individual performance. U.S.-based employees have access to healthcare benefits, paid time off, parental leave, a 401(k) plan and company match, short-term and long-term disability coverage, basic life insurance, and wellbeing benefits, among others.
This is not a complete listing of the job duties. It's a representation of the things you will be doing, and you may not perform all these duties.
