IT Admin

The IT Administrator owns day-to-day information technology, network and cloud infrastructure, business-systems support and development, and cybersecurity across Skyeton Inc.'s U.S. locations. This hands-on role supports employees and operational systems; administers endpoints, identity, networks, servers, collaboration platforms, source control, and cloud services; and maintains reliable, secure access to the technology the business depends on. The position also specifies, reviews, tests, and deploys changes to internal business systems and integrations, including AI-assisted development completed under human engineering review and established software-governance controls. The IT Administrator is responsible for security hardening, monitoring, incident response, access control, documentation, and technical compliance evidence supporting ITAR/EAR, Controlled Unclassified Information, NIST SP 800-171, DFARS View phone number on click.appcast.io, CMMC, and customer requirements. The role is an individual contributor initially and may grow into leadership of a small IT and security team. What you'll do End-User It And Endpoint Management Own the full endpoint lifecycle for every Skyeton Inc. US employee: procure, image, configure, deploy, patch, encrypt, support, recover, and retire laptops, desktops, mobile devices, and peripherals against a documented standard build. Provide responsive Tier 1 and Tier 2 support across all sites for endpoints, business applications, printing, conference-room technology, and shop-floor systems. Be the person people are glad to call. Administer the corporate email, collaboration, file-sharing, and cloud identity platform: directory and group management, multifactor authentication, conditional access, licensing, and permissions. Run onboarding and offboarding end to end with HR: account provisioning, group and role assignment, equipment issue, and — the part that actually matters for security — same-day, verifiable access removal on departure. Maintain an accurate asset, license, warranty, and configuration inventory. Track spend and lifecycle so equipment refresh is planned, not reactive. Network And Infrastructure Own the wired and wireless networks at every Skyeton Inc. site: switching, VLAN segmentation, firewalls, wireless, structured cabling, internet and carrier services, and the remote-access layer. Segment the production floor from the office. Network-connected manufacturing equipment — CNC, cure-room controls, test stands, booths, inspection gear — belongs on its own segment, with deliberate and documented rules about what may cross. Stand up the network and IT infrastructure for new sites and facility build-outs, from the cabling drawing to the day the first person plugs in. Administer Linux and Windows servers and the company's cloud footprint, in coordination with the existing infrastructure-as-code and following it — anything provisioned by hand and never mirrored into code is a rebuild failure waiting to happen. Own the remote-access and zero-trust network layer: device enrolment, group membership, access policy, and the identity checks behind it. Own backup, restore, business continuity, and disaster recovery. Test the restores and document the results — an untested backup is a hope, not a control. Monitor availability, capacity, storage, and alerting; investigate and resolve before users report the problem. Business-Systems Development Develop with AI coding agents — and own what they produce. Most of the code in these systems is agent-written under human direction and human review. That is how a company this size moves at the speed it has to, and it only works because a competent engineer stands between the agent and production. Concretely: Specify before you generate. What comes back is only as good as the problem statement, the stated source of truth for every value, and the constraints you handed over. Vague prompt, plausible garbage. Review as though you wrote it, because you are answerable for it. Read every line. Check it against the design, the data model, and the source-of-truth doctrine — not just against "does it run." An agent's output is a proposal, never an authority. Hunt the failure modes agents actually have: a value copied instead of pulled from its system of record; a silent fallback that swallows an error; a plausible-looking match that attaches the wrong record; an assumption that quietly disagrees with the rest of the system. These do not look like bugs. They look like working code. Test what you approve. Agent-written code gets the same tests, the same gates, and the same staging rehearsal as anything else — more, if anything, because nobody's fingers walked through the logic line by line. Know when not to use one. Some work — a security control, a credential path, a schema migration against live data — is worth doing slowly and by hand. Improve the harness itself: the project rules, the prompts, the tests, and the CI gates that make agent output reliable. When an agent makes the same mistake twice, that is a missing check, not bad luck. Work the governance pipeline as written, every time. Our software development plan is short, real, and enforced. In practice that means: A work item first. Nothing gets built before there is a work item defining it. A plan document, not a comment. The plan states the problem, the source of truth for every value, the design, the companion merge requests, verification, rollout, rollback, what "done" looks like, and the open questions. It is agreed before code is written. A merge request with a green pipeline. Fast-forward-only, rebased, squashed. A gate that cannot fail does not exist — no advisory checks, and nothing merges through a known-red pipeline. Rehearse on staging before production, same tool and same flags, from a fresh production restore. First-time code paths never execute on production first. Production deploys are deliberate and human-run — a prepared release script that a human reads and runs, never a CI button and never because a merge request landed. Every ERP extension is registered in the extensions register in the same commit, so the next person can trace every departure from stock. Done means finished. A change that needs something outside itself is not mergeable, and work does not end with a list of loose follow-ups. The rest of the development scope: Respect the source-of-truth doctrine. Data lives only in its system of record and is pulled from there. Nothing copies, caches, or re-keys data as a workflow. Before you write anything that holds a value, you ask where its source of truth is and whether what you are building is a view of it or a fork of it. Forks are the expensive kind of mistake and they are rarely obvious at review time. Support and administer the systems you build: ERP user and role provisioning, workflow and approval configuration, print formats, scheduled jobs, integrations, upgrades, and the unglamorous reliability work behind all of it. Protect separation of duties in ERP. A single-role individual must never be able to raise and approve the same document. Re-audit after every role grant — particularly the superuser roles, which bypass workflow controls entirely. Own the source-control server, the build runners, and the health of the pipelines. Infrastructure or pipeline changes freeze feature merges until proven — the gates cannot vouch for anything while they are moving. Own Skyeton Inc.'s technical security posture: secure baseline configurations, hardening standards, patch and vulnerability management, endpoint detection and response, logging and monitoring, and least-privilege access across every system. Hold the line on defense in depth. Every sensitive surface gets two independent checks, never one, and access is granted per group rather than per network. Every layer is updated when someone joins, changes role, or leaves — a surface still reachable by a departed employee is the failure this rule exists to prevent. Own secrets handling: secrets live in the approved secrets manager, never in a repository, never on a command line, never echoed to a log. Rotate immediately on any suspected exposure, and build the tooling so the safe path is the easy path. Own the technical controls and the evidence behind NIST SP 800-171, DFARS View phone number on click.appcast.io, CMMC, ITAR / EAR, and customer-specific cybersecurity flow-downs. Maintain the system security plan, the POA&M, and the artefacts an assessor will ask for — before they ask. Identify and mark Controlled Unclassified Information, enforce its handling rules, and implement FIPS 140-3 validated cryptography where CUI requires it. Know the difference between "encrypted" and "encrypted with validated cryptography," because for CUI only one of them counts. Run incident response: detection, triage, containment, investigation, notification, and corrective action. Every incident becomes a check — a test, a gate, or a control, so the same thing cannot happen twice. Run phishing simulation, security awareness training, and periodic access reviews with business owners. Support export-control compliance on the technical side: access segregation for controlled technical data, foreign-national access controls, and the audit trail behind both. Author and maintain the security management-system documents under Skyeton Inc.'s document standard, and keep the revision history in git. Vendor, Budget And Cross-Functional Manage managed service providers, carriers, software vendors, and equipment suppliers; drive service issues to resolution rather than merely tracking them. Evaluate technology needs, obtain quotes, recommend practical solutions, and support IT purchasing, lifecycle planning, and budget tracking. Report on system availability, security posture, open vulnerabilities, and business-systems delivery to the VP of Engineering and Manufacturing. Participate in after-hours maintenance windows and urgent incident response when the business needs it. All other duties as assigned by Skyeton leadership. Qualifications Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a closely related technical discipline. Equivalent demonstrated experience will be considered, but this role is engineering work and the bar is set there. 4+ years combining hands-on IT administration with real software development. We are looking for someone who has genuinely done both, not someone who has done one and read about the other. Scripting and software development you can show us — Python strongly preferred. You have written and shipped something a business depended on, and you can talk about how it was reviewed, tested, and released. Code review as a first-class skill. You can read code you did not write, understand what it is actually doing, and say clearly why it is wrong. Much of this role is judgement applied to someone else's — or something else's — output. Git and modern source-control discipline — branches, merge requests, code review, CI/CD pipelines. You have worked somewhere that took review and release process seriously, and you did not find it an obstacle. Willingness to develop with AI coding agents, and to be accountable for what they produce. Prior experience with Claude Code, Copilot, Cursor, or similar in a real codebase is a strong plus; the non-negotiable part is the temperament — you neither refuse the tool nor trust it. REST API integration experience — you have made two systems talk to each other in production, and you have dealt with what happens when one of them is down. Demonstrated experience administering Windows endpoints and a cloud identity and productivity suite (Microsoft 365 / Entra ID, Google Workspace, or equivalent): identity lifecycle, MFA, conditional access, groups, and permissions. Linux server administration — you are comfortable on a shell, with systemd, logs, packages, and services. Networking you can defend in an interview: TCP/IP, DNS, DHCP, routing, VLANs, managed switching, firewall rule design, VPN, and wireless. You can read a packet capture and explain what you are looking at. Cybersecurity fundamentals in practice, not just in theory: least privilege, secure baseline configuration, network segmentation, vulnerability management, logging and detection, incident response, and data protection. Working familiarity with at least one compliance framework — NIST SP 800-171, NIST SP 800-53, CMMC, ISO 27001, or similar — including what evidence actually satisfies a control. Clear technical writing. Our plans, runbooks, and security documents are read by people who are not you. Ability to prioritise ruthlessly across three lanes of work and communicate honestly about what is and is not getting done. High integrity and discretion. This role sees payroll systems, financial systems, export-controlled technical data, and every credential in the company. US citizen, able to obtain and maintain a US security clearance, and able to work under ITAR / EAR controls. Preferred Qualifications CompTIA Security+ (DoD 8140 / 8570 IAT Level II baseline). If you do not hold it, we expect you to earn it within twelve months and we will pay for it. Additional certifications, held or in progress: CompTIA Network+, CySA+, or CASP+; Cisco CCNA or CCNP Security; Microsoft SC-200 / SC-300 / AZ-104; GIAC (GSEC, GCIH, GCIA); CISSP or CISM for a more senior candidate. Hands‑on experience implementing NIST SP 800-171 and preparing for a CMMC assessment — the system security plan, the POA&M, and the evidence behind them. FIPS 140-3 validated cryptography experience, and a working understanding of where FIPS validation is required versus where strong encryption alone is enough. Public-cloud experience, AWS preferred — compute, VPC and subnet design, identity and access management, secrets and parameter storage, object storage, monitoring, backup and snapshot strategy, and cost management. Experience in a cloud region operating under a US government compliance boundary is a significant plus, as is any cloud certification (AWS Cloud Practitioner, Solutions Architect Associate, SysOps Administrator, or Security Specialty, or the Azure equivalents). Infrastructure as code — Terraform, Ansible, or CloudFormation — and a genuine dislike of hand‑built servers. Substantial experience developing with AI coding agents in a production codebase, including what you changed about your own review habits once you started. ERP development or extension experience on any major platform — SAP, NetSuite, Odoo, Dynamics, or an open‑source ERP — including custom objects, workflows, permissions, and API integration. Administration of a self-hosted source‑control and CI platform (GitLab, Gitea, Bitbucket Server, or similar), runner management, and pipeline authoring. Zero‑trust or overlay‑network experience and access‑policy design for a mesh or software‑defined perimeter. API integration work against commercial accounting, expense, HR, or similar business platforms. Experience supporting aerospace, defense, or another regulated manufacturing environment; familiarity with production‑floor systems, CAD, PDM, or MES. Experience in a startup, greenfield, or rapidly scaling organisation — you have been the whole IT department before and it did not break you. Active or recently held US security clearance. US military veteran or DoD program experience; familiarity with the NC / Sandhills / Fort Bragg labor market. Genuinely dual‑skilled. You are credible as an engineer to engineers and as an IT professional to everyone else, and you do not treat either half as beneath you. Process discipline you own rather than resent. You write the plan before the code gets written because you have seen what happens when nobody does. You do not route around a rule you disagree with — you change it in a work item. Skeptical review. You are hard to impress by fluent output, from a person or from a model. You check the claim against the system rather than against how confident it sounds, and you are comfortable sending work back. Security instinct. You notice the access that was granted for one afternoon and never revoked, and the workflow that lets one person raise and approve the same thing. You raise it before it becomes an incident. Service orientation without being a doormat. You make people's technology work and you are pleasant about it, and you still hold the line on the controls that matter. Ruthless prioritisation. Three lanes and one person means something is always waiting. You are honest about what, and why, and when. Documentation as a habit. Network diagrams, runbooks, plans, and security artefacts are current because you keep them current, not because an audit is coming. Comfort with ambiguity in a stand‑up environment. Much of the environment is half‑built. You improve it a piece at a time instead of waiting for a clean slate. Candid communication. You tell leadership what is actually broken, what it will cost to fix, and what the risk is if we do not — early and plainly. Follow‑through. Done means finished. You do not leave a trail of ninety‑percent‑complete work behind you. Paid Time Off (PTO) 401(k) plan with company match Medical insurance: company-paid employee coverage Dental and vision insurance Competitive salary commensurate with experience Sign‑on and relocation assistance may be negotiable Equity eligibility in accordance with Skyeton compensation policy Company‑funded training and role‑relevant professional certifications Bonus opportunity tied to company milestones and ongoing performance Career growth opportunities within a rapidly expanding aerospace organization Full‑time, on‑site in Fayetteville, NC. Office and industrial manufacturing environment with regular movement throughout the facility. Ability to remain at a workstation for extended periods, and to walk, stand, bend, reach, kneel, work in server and network rooms, and pull cable in ceilings and equipment areas. Ability to lift and carry equipment up to 40 lbs (workstations, monitors, switches, UPS units), with or without reasonable accommodation. Comfortable working on a production floor around chemical, noise, dust, and machinery hazards; willing to wear required PPE (safety glasses, hearing protection, steel‑toed footwear) consistently and correctly. Ability to travel domestically ~20–30%. This is a multi‑site role: network, endpoint, and security work has to be done in the building, so expect regular trips to the Skyeton Inc. sites in North Carolina and Nevada, plus vendors and training. Availability for after‑hours maintenance windows, outages, and security incidents. Infrastructure work happens when people are not using the infrastructure. Ability to handle export‑controlled, CUI, and confidential information per Skyeton Inc. policy. Equal Opportunity Statement Skyeton is an Equal Opportunity Employer. We are committed to creating an inclusive environment for all employees and applicants. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other legally protected characteristic. Skyeton participates in E-Verify. This position is subject to U.S. export‑control regulations (ITAR/EAR) and requires eligibility for a U.S. security clearance. Applicants must be U.S. citizens and able to obtain and maintain a U.S. security clearance and any additional clearances required by Skyeton's customers and contracts. A pre-employment background check, drug screen, and reference verification ar About Skyeton, Inc Skyeton is an aerospace and defense technology company focused on the design, production, and support of advanced unmanned aerial systems. At our growing Fayetteville, North Carolina operation, employees help establish and scale U.S.-based manufacturing capabilities that support demanding customer missions. Company Culture Skyeton combines the energy of a growing organization with the discipline required in aerospace manufacturing. We value teamwork, accountability, practical problem‑solving, precise execution, and a willingness to improve. Our people make a difference, and every employee contributes directly to product quality, operational readiness, and customer success. #J-18808-Ljbffr Skyeton, Inc