IT Systems Administrator

• Own Okta as the control plane: SSO (SAML/OIDC), SCIM provisioning, group rules, profile/attribute mapping, authentication policies, MFA/FastPass, and admin role scoping

• Drive Okta to be the single source of provisioning for every eligible app; migrate remaining Rippling-provisioned apps and configure SCIM where supported but unused

• Design and maintain RBAC by department, role, and seniority; publish and maintain access control matrices

• Build birthright access, time-bound access (e.g., international travel), and automatic revocation

• Govern service and shared accounts: inventory, ownership, conversion to named accounts, credential rotation

• Run recurring access reviews and produce audit-ready evidence for SOC 2 and security reviews

• Partner with Security on zero-trust posture, device admission, geofencing, and Okta system log monitoring

• Design, build, and maintain automations in

, connecting Okta, Rippling, Ashby, the ticketing platform, Slack, Google Workspace, Notion, and business apps

• Use REST APIs, webhooks, OAuth/API tokens, and JSON payloads confidently; read vendor API docs and build reliable integrations with error handling, retries, logging, and alerting

• Automate the employee lifecycle end to end: pre-hire prep, staged Okta creation and timed activation, Day-1 access, role/department changes, and offboarding with access revocation and audit trail

• Partner closely with HR / People Ops on lifecycle management: agree on HRIS data standards and trigger timing, coordinate start dates, role changes, leaves, and terminations (including sensitive or same-day exits), and handle HR data with discretion

• Turn access requests into self-service catalog items with approval routing by app sensitivity (Slack approve/deny, owner approvals, automatic provisioning on approval)

• Treat automations as production systems: version control or exportable definitions, documentation, runbooks, credential hygiene, least-privilege service accounts, and ownership

Our fleet is roughly 85% macOS and 15% Windows. Mac is the default, but Windows users get the same level of support, security, and polish.

• Own MDM across macOS and Windows (Iru; experience with Kandji, Jamf, and/or Intune expected): enrollment (ABM/ADE, Autopilot), blueprints/profiles, compliance baselines, patching, app deployment, and FileVault/BitLocker

• Maintain and extend Okta Device Trust (device identity certificates, managed-device attestation, desktop and mobile auth policy rules)

• Harden enrollment controls so factors and devices can only be enrolled from managed, compliant hardware

• Own hardware lifecycle tooling and data: assignment, shipping, recovery, resale/disposal, and reconciliation with Finance

• Serve as frontline support for Medely Help (our ticketing platform): identity, device, SaaS, and cross-system issues

• Handle the occasional hands-on fix with care: password/MFA resets with proper identity verification, break/fix troubleshooting, and remote machine replacement (ship, wipe, re-enroll, recover)

• Own ticketing platform configuration: request catalog, forms, routing, categories, SLAs, inbox boundaries (privacy-aware for HR/sensitive queues), and AI triage behavior

• Maintain a strong Helpdesk Knowledge Base and IT internal runbooks in Notion

• Help build sustainable IT operating rhythms: roadmap hygiene, weekly status, ownership on every card, and visible deadlines

• Own Zoom Workplace administration: Okta SSO and SCIM provisioning, license types and assignment, roles, groups, account- and group-level settings and locks, and add-on management

• Manage meeting and recording policy: cloud recording settings, retention, sharing defaults, and access controls aligned with Security and Legal

• Govern Zoom AI Companion and other AI features: who has them, what's enabled, and how summaries and recordings are stored and shared

• Administer Zoom Phone end to end: number inventory and assignment, porting, call queues, auto receptionists/IVR, business hours and holiday routing, voicemail, and call handling for operational teams

• Own Zoom Phone compliance and reliability: emergency (E911) addresses, call recording policies and notices, SMS/10DLC registration, and call quality troubleshooting

• Build Zoom and Zoom Phone into the employee lifecycle: automatic license and number assignment on hire, call queue and routing updates on role changes, and number reclamation, recording handoff, and license recovery on offboarding

• Track Zoom usage and licenses to right-size seats and Zoom Phone plans at renewal

• Enable AI tools (Claude, Notion AI/agents, and new entrants) through Okta SSO/SCIM, group-based entitlements, usage controls, and approval workflows

• Build AI-assisted IT workflows (ticket triage, KB drafting, access request intake, reporting) with human-in-the-loop checkpoints where risk warrants

• Design, build, and maintain governed AI integrations using LLM APIs (Anthropic/OpenAI), MCP connectors, and AI agents (including Notion agents and n8n AI nodes), with scoped credentials, data boundaries, logging, and clear ownership

• Put safeguards in place for

employee using AI tools: approved-tool list, data classification guidance (what never goes into a prompt: PII, PHI, credentials, customer data), connector and integration scoping, admin settings like data retention and training opt-outs, and audit logging

• Make safe use the easy path: short, practical guidance and training in Notion, a clear request path for new AI tools, and fast reviews so people don't route around IT

• Partner with Security and Legal on AI acceptable-use policy, vendor reviews, and periodic checks of how AI tools are actually being used

• Own Torii as the system for SaaS discovery: find unsanctioned apps, OAuth grants, and browser-extension sign-ups, and triage them (approve and bring under Okta, replace with a sanctioned tool, or shut down)

• Assign a business owner to every app and keep the SaaS inventory current

• Use Torii usage for automated license reclamation and consolidation

• Build automations off Torii signals (new app detected, unused licenses, upcoming renewals) into the ticketing platform, Slack, and Notion

• Apply least privilege and zero-trust principles to every system you touch, including your own admin access and automation service accounts

• Monitor Okta System Log and admin activity; investigate suspicious sign-ins, unexpected factor enrollments, and policy failures with Security

• Keep secrets out of tickets, Slack, and workflows; use 1Password and scoped API tokens, and rotate credentials

• Administer

: Okta-integrated provisioning, vaults and shared-vault structure by team, groups and permissions, policies, recovery and reporting

• Support incident response: document, contain, and run post-incident follow-ups that close the underlying control gap

• Help with security awareness for employees (phishing, MFA hygiene, device hygiene) and support Security on SOC 2 controls and evidence

• Design clean, relational IT data in Notion (and connected sources): SaaS inventory and status, app ownership, access matrices, asset inventory, roadmap, and ticket insights

• Define sources of truth and sync patterns between HRIS (Rippling), identity (Okta), ticketing platform, and Notion so reporting is accurate and automatable

• Build dashboards and metrics: ticket volume and categories, time to resolve, provisioning coverage, SCIM coverage, device compliance, license utilization, and SaaS spend

• Support SaaS audits, renewals, and license reclamation with real usage data

• Administer Notion as a core company platform: teamspaces, permissions and sharing patterns, SCIM/SSO, databases, forms, automations, and AI agents

• Help departments build in Notion without oversharing or shadow IT; set standards and templates

• Fully onboarded on Okta, Iru, the ticketing platform, n8n, and Notion admin; owns a defined set of IT Roadmap workstreams with weekly deadlines met

• Delivers a provisioning gap report: every app's SSO / SCIM / provisioning source / shared-account status, with a remediation plan

• Ships at least 2-3 production automations that measurably remove manual ticket work (e.g., top app access requests)

• Completes a Torii shadow-IT review: every discovered app is triaged, has an owner, and is either sanctioned under Okta or retired

• Audits Zoom and Zoom Phone: license and number inventory, call queue and routing map, E911 addresses, and recording settings, with fixes for any gaps

• Okta is the provisioning source for all eligible apps; Rippling-provisioned gaps closed

• Access requests for top apps are self-service with policy-based approvals and auto-provisioning

• Onboarding/offboarding is triggered, timed, and audited end to end

• Ticket deflection and time-to-resolve trend in the right direction, with a monthly ticket insights report

• Quarterly access reviews are automated and audit-ready

• Device compliance and device trust coverage near 100% across macOS and Windows

• IT operational data (SaaS, access, assets, tickets) is trusted and powers dashboards and AI-assisted workflows

• 4+ years in IT operations / systems administration / IT engineering in a SaaS-first, remote company

• Deep, hands-on

: SSO (SAML/OIDC), SCIM, group rules, attribute mapping, authentication policies, Device Trust, and Okta Workflows

• Hands-on

(Iru/Kandji, Jamf, and/or Intune), including ABM/ADE, Autopilot, compliance policies, and app deployment

• Genuinely comfortable supporting

experience: licensing and app deployment (Word, Excel, PowerPoint, Outlook), Entra ID basics, coexistence with Google Workspace, and supporting Office apps on both macOS and Windows

• Proven experience building

Hands-on experience building with LLM APIs (Anthropic/OpenAI), MCP connectors, and AI agents. You scope access to least privilege, protect sensitive data, keep a human in the loop where risk warrants, log what the AI does, and document how it works

• Strong understanding of least privilege, RBAC, joiner/mover/leaver processes, and SOC 2-aligned IT controls

• Proven partnership with

on employee lifecycle management: onboarding, transfers, leaves, and offboarding, built on clear handoffs, shared data standards, and confidentiality

• Hands-on

experience (Business or Enterprise): provisioning, vault design, permissions, policies, account recovery, and shared-credential governance

• A security-minded approach: comfortable reading auth logs, spotting risky configurations, and pushing back when convenience would weaken a control

• Experience with SaaS management / shadow IT discovery (Torii, Productiv, Zluri, or similar)

• Google Workspace administration (groups, shared drives, security settings, data transfer)

• Hands-on

able to explain complex technical solutions in plain English to executives, HR, Finance, and everyday users, and to turn vague business needs ("I just need it to work like this") into clear technical requirements, designs, and workflows

• Clear writer: produces runbooks, KB articles, and decision docs that technical and non-technical readers can both follow

• Reliable owner: keeps work visible, meets deadlines, raises blockers early

•

• Okta Certified Professional

• Okta Certified Administrator (Okta Certified Consultant / Workflows a plus)

• Notion certification (Notion Admin / Notion Essentials or equivalent)

• Apple Certified Support Professional / Apple Deployment and Management

• Microsoft Endpoint Administrator (MD-102) or equivalent Intune certification

• Jamf or Kandji/Iru certification

• Google Workspace Administrator certification

• Zoom Phone or Zoom Workplace admin training/certification

• Security fundamentals (CompTIA Security+, or similar)

experience: workspace administration, inboxes and teams, assignment and routing rules, workflows and bots, Fin AI, help center, and integrations

• Scripting: Python, JavaScript, Bash, or PowerShell

• Rippling, Ashby, Torii (or similar SaaS management), Material Security, Slack admin/Workflow Builder

• Touchpoints with GTM systems, especially Salesforce: user and license management, profiles and permission sets, Okta SSO/provisioning, connected apps and integration users, and sandbox access

• Familiarity with the broader GTM stack: Gong / Gong Engage, Salesloft, HubSpot, LeanData, ZoomInfo, Clay, Gainsight, Intercom, Segment, and Letter.AI (or similar sales engagement, routing, enrichment, and CS tools)

• Experience partnering with RevOps / GTM Systems on access bundles, onboarding and offboarding across GTM tools, integration and API token governance, and license true-ups

• Basic data modeling; building dashboards in Notion, Metabase, or Tableau

• Supporting audits (SOC 2) with evidence collection

• Competitive Compensation: Based on experience and performance

• Long-term Incentives: 401k

• Healthcare Benefits: Full suite of benefits including medical, dental, and vision insurance

• Flexibility: We believe that work/life balance is important, so we offer flexible and unlimited PTO

• Paid parental leave

• Purpose: Join a growing mission-oriented startup that is modernizing the healthcare industry nationally!

• Ownership: Drive meaningful business impact on a team you'll help build and define!

• Remote: Work in a digital environment with all the tools to achieve your work as though you were in the office!

We're an equal opportunity employer to all. We interview and hire applicants of all backgrounds, orientations, expressions, and identities.

Work location is flexible if approved by Medely.

Medely does not accept unsolicited resumes from agencies. We consider any resume (CV) or biography received from an agency or outside recruiter without prior approval from a member of the Medely Human Resources or Recruiting team to be unsolicited and gratuitous, and such submissions will not be recognized by Medely for purposes of "ownership" of the candidate.

We are an E-Verify company.