Cambridge, MA (on-site) 3 Full-time
Position summaryWe're hiring a Senior IT Engineer to own the systems that run Walden's corporate IT: identity, endpoints, the infrastructure underneath them, and the helpdesk as a service. You report to a hands-on Head of IT & Infrastructure. You are one of three IT employees, alongside a Corporate Security Engineer, with contractor partners who handle Tier 1 support, field work and specialist projects.
This is an engineering and ownership role first. Contracted Tier 1 technicians work the queue using playbooks and escalation paths you design. You handle the escalations that need an engineer and fix root causes so they don't come back. Most of your time goes into building and running platforms. You'll move our fleet from JumpCloud to Fleet, run Okta and access reviews, keep our virtualization and storage healthy, and turn new-hire setup and new-site stand-up into repeatable kits.
You'll succeed if engineers building robots never think about IT, auditors can see our controls working, and each new hire, device or site takes less hands-on effort than the last. You'll be the visible face of IT in Cambridge.
What you'll own1. Identity and access. Run Okta and Google Workspace as production platforms.
- Administer SSO and SCIM, and automate joiner-mover-leaver so access follows HR data, not tickets.
- Run periodic access reviews and produce the evidence our SOC 2 controls rely on, with the Corporate Security Engineer.
- Own onboarding and offboarding end to end. Every hire is ready on day one, and every leaver loses access on schedule.
2. Endpoint platform. Own device management for our macOS, Linux and Windows fleet, plus mobile.
- Lead the migration from JumpCloud to Fleet. Then own MDM policy, zero-touch provisioning, patching and compliance reporting.
- Make sure every device is enrolled, encrypted and running CrowdStrike before it reaches a user.
- Drive down the hands-on technician time it takes to deploy a machine, and measure it.
3. Infrastructure operations. Run the on-prem infrastructure day to day.
- Operate our Proxmox virtualization and Ceph storage.
- Operate the Cisco Meraki switching and wireless estate and 802.1X network access, and direct field technicians for hands-on work, partnering with the Head of IT on network design and the Corporate Security Engineer on firewall policy.
- Write the runbooks and monitoring that let someone else operate a system at 4 a.m. Nothing you build is done until it's documented, monitored and has a named owner.
- Partner with our resilience engineer so the systems you run have tested backups and recovery targets.
4. Helpdesk as a service. Own support as a product. Enable Tier 1 to deliver it.
- Set the service levels, escalation paths and quality bar in Jira Service Management, and hold our Tier 1 partner to them.
- Write the playbooks that let a new Tier 1 technician be productive in their first week.
- Handle escalations that need an engineer, and fix the cause rather than the symptom. Personal queue work is expected to stay under about 20% of your week.
- Report on queue health, ticket trends and user satisfaction, and fix the top drivers upstream.
- Plan the user side of platform changes: rollout communications, short training, and self-service guides so changes don't become tickets.
5. Systems of record and SaaS. Keep the data IT runs on accurate.
- Own the CMDB and asset lifecycle: procurement, inventory, refresh and secure disposal.
- Administer Box and other SaaS tenants. Bring new tools behind SSO with sensible defaults, including AI tools.
6. Scale and delivery. Make growth easy for IT.
- Build a remote-site kit covering network, identity, devices and support, so a new site can be stood up from a checklist.
- Automate repetitive work with scripts, APIs and infrastructure-as-code, and use AI tools where they help.
- Run IT's biweekly roadmap review, and deliver projects the Head of IT hands you, including contractor-delivered projects.
- Plan work with the Head of IT, and direct and review contractors working on your platforms.
In your first year- Every new hire has a working machine and access on day one. That's the floor, not the goal.
- Every device is enrolled in Fleet and compliant, and hands-on deployment time is measurably lower than the baseline.
- A new Tier 1 technician is productive in their first week from your playbooks alone.
- A new remote site has been stood up from the standard kit.
- Access reviews and device compliance produce audit evidence without anyone chasing it.
What you bringRequired- 5+ years in corporate IT or systems engineering (8+ without a degree). At least 3 of those years as the accountable owner of production platforms, not only a user of them.
- Production admin of an identity provider (Okta preferred): SSO, SCIM provisioning, lifecycle automation and access reviews.
- Production ownership of an MDM platform across macOS and at least one of Linux or Windows: zero-touch provisioning, patching and compliance policy. Ideally including a migration you led.
- Hands-on operation of virtualization and storage in production (Proxmox, VMware or Hyper-V; Ceph, SAN or NAS), including upgrades and recovering from a failure.
- Experience directing an MSP, contractors or a Tier 1 team against service levels and documentation you wrote.
- Automation in Python, Bash or PowerShell against vendor APIs. You can show us something you automated and what it saved.
- Enough enterprise networking to operate and troubleshoot it: VLANs, DHCP/DNS, Wi-Fi, 802.1X, VPN or zero-trust access.
- Clear writing. Your runbooks work for someone else, and you explain trade-offs plainly to engineers and non-technical staff alike.
Preferred- Fleet or osquery, JumpCloud, or Jamf, including a migration between MDMs.
- Cisco Meraki, and Tailscale or another WireGuard-based access tool.
- Jira Service Management and a CMDB. Google Workspace and Box admin.
- Infrastructure-as-code or configuration management (Terraform, Ansible or similar).
- Operating controls in a SOC 2 or ISO 27001 environment. Vanta or a similar platform.
- Supporting Linux-heavy engineering teams (robotics, embedded, ML or similar).
- Basic AWS IAM and account hygiene.
- Using AI tools (Claude, ChatGPT) to speed up your own work, and helping others adopt them safely.
- Early-stage or growth-stage startup experience.
Logistics- Location: On-site at our Cambridge, MA office. This role is not remote.
- Travel: Up to about 15%: our Boston office, the San Francisco office, and new remote sites as they open.
- Hours: Business hours, plus planned maintenance windows. You're the escalation point for incidents on the platforms you own. We'll formalize an on-call rotation as the team grows.
- Physical: Able to lift 40 lbs and work in network closets, IDFs, server racks and lab spaces.
- Background check: Standard pre-employment check.
Walden Robotics offers a competitive total compensation program, including salary, annual cash bonus, company equity, company-subsidized insurance programs, 401(k) with company match, flexible PTO, daily lunch, and other benefits. The pay ranges noted on our posts are for salary only.
Walden Robotics offers a competitive total compensation program, including salary, annual cash bonus, company equity, company-subsidized insurance programs, 401(k) with company match, flexible PTO, daily lunch, and other benefits. The pay ranges noted on our posts are for salary only.
The pay range for this role is:
175,000 - 227,500 USD per year (Cambridge, MA)
