IT Operations Manager

The RoleKaizen builds software for federal and local government. We are roughly 80 people on a cloud-first, mostly macOS stack, and we sell into customers who impose real requirements on how we run our own corporate systems.IT here is currently distributed across engineers and operators who all have other full-time jobs. It works, in the sense that people can log in. Selling into government means holding a higher bar on identity, devices and access than a side-of-desk model can sustain, so we are building the layer properly. This engagement does that and leaves behind something that runs without you.Hands-on build work: deploying tools, writing policy, and cleaning up account sprawl rather than advising on it.What You'd OwnIdentity. We are partway through consolidating everything behind a single identity provider and the tail is where the value is: the applications nobody wanted to touch, the provisioning that still happens by hand, and the lifecycle rules that turn it into a system. You would finish it and then own it, including automated provisioning and deprovisioning.Endpoints. Device management is a program you would stand up rather than one you would inherit. Our government customers set requirements on the devices used for their work, and this role owns meeting those requirements and evidencing them. You would select the tool, deploy it across the fleet, and write the policy that goes with it. This is the largest single deliverable in the engagement.Employee lifecycle. Joiner, mover, leaver. Today both are documented processes rather than instrumented ones. You would turn them into a system with timing, an audit trail, and named owners, including credential and hardware return. One design constraint: some of our contracts specify tight windows for disabling access when someone departs, so the leaver path has to be built against a clock and produce evidence that it met it.Access reviews. A recurring review of who has access to what, on a cadence, producing evidence rather than a screenshot. Our auditors and our government customers both ask for this, and you would own the cadence and the trail.A scoped enclave. Some of our government work involves controlled information with handling requirements that do not apply to the rest of the business. You would stand up a separate, deliberately narrow environment for it, with its own identity, managed devices, controlled storage and a documented boundary, then write the runbook that keeps the scope from drifting. Keeping that boundary narrow over time is harder than building it.The SaaS estate. Inventory, owners, renewal dates, who has admin, and what data sits where. Right now that knowledge is in people's heads.DeliverablesWhat we expect to have in hand at each stage.Weeks 1 to 4A complete inventory of devices, applications, and accounts, each mapped to a named human and reconciled against current employment statusThe identity provider rollout finished across the remaining applications, with the queued work closed outA written joiner, mover and leaver process with the revocation step timed and evidencedWeeks 5 to 12Endpoint management selected, purchased and deployed across the fleet, with a device and acceptable-use policy that lets us evidence the software restrictions our contracts carryA quarterly access review established, in a format an assessor will acceptOffboarding automated end to end, including credential and physical asset return with written confirmationSaaS estate rationalized: inventory, owner, renewal date, admin list, and data posture for eachMonths 3 to 6Privileged access separated from standard access and documentedIdentity and access evidence flowing to our compliance program on a scheduleThe scoped enclave stood up and documented, with a defined user list and a boundary that holdsReadiness for certificate and smart-card based authentication, which some of our government work will requireRunbooks good enough that the program survives the end of this engagementWhat You'll BringYou have owned a modern identity provider, Okta, Entra or JumpCloud, as the administrator rather than a user. App onboarding, SCIM provisioning, lifecycle rules, and the unglamorous work of chasing down the last twelve applicationsYou have deployed endpoint management from zero across a real fleet. Jamf, Kandji, Hexnode or Intune. You know what breaks when you do this to people who have never had a managed device, and you have a plan for that conversationYou have paired endpoint management with an EDR tool and can speak to both halves. CrowdStrike, Huntress or similarYou have built a joiner, mover and leaver process that produced an audit trail, not a checklist someone remembers to openYou have run an access review that an auditor accepted. You know the difference between a spreadsheet and evidenceYou are fluent in a cloud-first, mostly macOS environment: Google Workspace, a password manager, AWS console access, SSO everywhereYou write runbooks other people can follow. This engagement is judged partly on what still works after it endsYou are comfortable as the only IT person, with an engineering team who will help you but does not report to youUS personStrong Candidates May AlsoHave taken a company through SOC 2, FedRAMP or CMMC on the IT side and know exactly which access and device artifacts the assessor asks for. This is the single most valuable thing on this list and it moves our rateKnow certificate and smart-card authentication, PIV or CAC, and government PKIHave handled device, software or account restrictions that flowed down from a government contractHave come out of a managed service provider and want to build in-house instead of firefighting across twenty clientsHave done exactly this as a contract engagement before and can describe what made it work or failScope of WorkProduct engineering and our government hosting environments stay with employees. You would own corporate identity and corporate devices, not the production or federal environments. Security architecture decisions sit with our engineering lead; you would implement and operate.Don't Apply If...Your background is ticket triage and password resets. This engagement designs and builds systems, and there is no queue to workYou need an established stack and a documented environment to step into. Neither exists yet, and building them is the jobYour experience is Windows and on-premise Active Directory. It does not transfer cleanly to where we areYou want a retainer to advise. We need someone who buys the tool and deploys itYou would rather grow a team than do the work yourself. There is no team, and there will not be one during this engagementWhat Kaizen OffersHealth & Insurance100% coverage across the board: medical through Oxford/United (Gold and Platinum PPO plans), dental through Guardian PPO, and vision through Beam — all fully covered for employees, with 100% coverage for dependents.$100,000 in fully paid life insurance. FSA and Dependent Care FSA.One Medical membership, on us — same-day primary care, 24/7 virtual visits, and offices all over the city.Fertility and family-building support through Carrot.401(k) through Guideline, with a 2% company match.Family & Time Off16 weeks of fully paid parental leave for birthing parents. 10 weeks fully paid for non-birthing parents.Unlimited PTO, with a two-week minimum (we mean it when we say take time off!)Closed for all federal holidays.Company-wide winter break the week of Christmas.Company offsites throughout the year.Office & Remote Setup