Google Workspace Administrator (Washington DC-Baltimore Area)

Job details:

Role: Google Workspace Administrator

Location: Hybrid —Washington, DC

Period of Performance: 12+ Months Contract

Clearance: Public Trust suitability + OPM FBI fingerprint criminal background check with financial/credit review; re-screened annually

Role Summary:

As an US Citizen , you gace to work as a Google Workspace Administrator, who will be the single dedicated full-time resource responsible for administering, governing, and optimizing USHMM's entire Google Workspace tenant. This person is the primary point of contact for all Workspace-related activity — configuring the platform to meet business, security, and compliance requirements, and providing technical training and documentation to the Museum's existing team of roughly 6–8 Google administrators. This is a senior individual-contributor role: the person owns the environment end to end and works across all support tiers depending on the problem, not just Tier 3.

Environment You'll Be Administering

This is a large, mature enterprise tenant — not a small shop. Scope includes:

• ~902 active users (925 provisioned), 22 organizational units, 653 groups
• 1,294 shared drives, 23.5 TB Drive storage, ~47 TB total footprint
• 908 Workspace licenses, 1,743 archived-user licenses, 26 Google Voice licenses
• 40 privileged administrators to coordinate with and govern
• 1 primary domain, 2 secondary domains/aliases
• Okta as the identity source of truth (SSO/MFA already in place)
• ServiceNow for ticketing, change, and incident workflow
• Jamf (Apple), Google MDM (mobile), Endpoint Central (everything else)
• Third-party CASB for DLP; Google Vault with indefinite retention
• Commercial Workspace tenant, with an active initiative to move toward FedRAMP Moderate

Core Responsibilities:

Platform Administration & Account Management

• Administer all Workspace domains and services as primary owner
• Manage users, groups, OUs, and role-based access controls
• Own identity lifecycle: onboarding, role changes, offboarding
• Manage licensing, subscriptions, and cost/storage optimization (Drive storage and license right-sizing are named priorities)

Core Service Management

• Administer and optimize Gmail, Drive, Docs/Sheets/Slides/Forms, Meet, Chat, and Calendar
• Stand up and support Gemini for Workspace and NotebookLM for internal Museum use

Security & Access Controls

• Enforce MFA for all users, mandatory for privileged accounts
• Configure and maintain SSO/identity federation via Okta
• Enforce password, session-control, and device-trust policies
• Manage DLP, IRM, and secure-sharing controls in coordination with the CASB
• Monitor security alerts; respond to phishing, account compromise, and unauthorized access

Compliance & Risk Management

• Maintain alignment with NIST CSF, NIST SP 800-53, and FISMA
• Support the migration toward FedRAMP Moderate consistent with Museum direction
• Maintain documentation and evidence supporting audits, assessments, and ATO activities
• Understand that federal PII is treated as CUI, with State Privacy Acts, PCI, and HIPAA also in scope, and NARA/M-19-21 records-management requirements in effect

Operations & Maintenance

• Routine health checks, configuration reviews, and policy/feature updates
• Change management to minimize disruption; incident, outage, and escalation response
• After-hours/weekend response for critical or mission-critical outages (normal coverage is business hours)

Planning & Optimization

• Lead strategic planning for Workspace adoption; maintain a continuous-improvement roadmap
• Evaluate new features for Museum applicability; recommend automation and UX improvements

Stakeholder Coordination & Training

• Serve as liaison among Museum leadership, IT, program offices, and Google support
• Provide technical training and best-practice guidance to the Museum's Google administrators and broader community

Deliverables the Person Owns

Governance/administration documentation, security and access-control policies, NIST/FISMA/FedRAMP-aligned compliance documentation, operational runbooks and incident-response procedures, user lifecycle procedures, and monthly status reports.

Required Qualifications:

• Google Workspace Administrator Professional certification, current and in good standing — this is mandatory, not preferred. No exceptions; a candidate without it is non-compliant.
• Hands-on experience administering Google Workspace at large enterprise or federal/federal-adjacent scale (hundreds to ~1,000 users, complex OU/shared-drive structures)
• Strong identity management, MFA, and zero-trust fundamentals; direct Okta experience strongly desired
• Experience supporting NIST-, FISMA-, and FedRAMP-aligned environments
• Able to obtain Public Trust suitability and pass an OPM fingerprint criminal check with credit/financial review
• U.S. citizenship or work authorization; able to work onsite in Washington, DC on a hybrid schedule (~10 onsite days/month, five every two weeks)

Preferred Qualifications:

• Google Cloud Certified — Professional Cloud Security Engineer
• Google Cloud Certified — Professional Cloud Architect
• ServiceNow, Jamf, Endpoint Central, and CASB/DLP tooling familiarity
• Experience with Google Vault retention and NARA records-management requirements