IT Systems Administrator

The CompanyMedely is a high-growth series-C technology start-up reimagining the future of healthcare work by providing an on-demand marketplace and workforce management tools. With the support of top-tier investors, Medely has quickly become a go-to platform for healthcare professionals to instantly access high-paying jobs with the freedom and flexibility to work when and where they want. As a fully remote team of sharp, collaborative, and entrepreneurial individuals, we are dedicated to redefining the way healthcare workers and facilities work together to provide for patients. We are looking for passionate and skilled professionals to join our team and help us take on tough challenges in this fast-expanding healthcare industry segment. Join us in our mission to transform the healthcare staffing industry and improve patient lives! The RoleMedely's IT team is small, high-leverage, and remote-first. We support a distributed workforce on a modern SaaS stack including, but not limited to, Okta, Google Workspace, Slack, Zoom and Zoom Phone, Notion, our ticketing platform (Medely Help), Iru MDM, Rippling, Ashby, Torii, and dozens of business apps. Day-to-day support volume is modest and well-documented; most of this role's time goes to building, securing, and automating the systems underneath. This role is a hybrid: part hands-on IT generalist (the occasional password/MFA reset, break/fix, or machine swap, plus the employee lifecycle), part IT Systems Administrator (owner of identity, device, and SaaS architecture), and part automation architect (the person who turns repeated work into workflows, APIs, and safe AI-assisted processes), all with a security-first mindset. You'll be the engineer who makes access control automatic, auditable, and least-privilege by default, and who makes IT's operational data clean enough to measure, report on, and automate against. Why This Role ExistsSupport is manageable, but it can be smarter. Truly hands-on IT work (a password reset here, a laptop replacement there) is light. The bigger opportunity is the repeatable stuff, like app access requests, which should be self-service, policy-driven, or fully automated.SaaS sprawl and shadow IT are real. Teams adopt tools quickly. We use Torii to discover and govern them, and we need someone to turn those findings into ownership, Okta-backed access, and renewal decisions.Access control still has manual seams. Some apps are provisioned from Rippling instead of Okta, some support SCIM but aren't configured, shared service accounts need governance, and RBAC for Sales/RevOps and other departments needs to be operationalized end to end.The lifecycle has timing and trigger gaps. Rippling → Okta activation timing, Ashby/Rippling → ticketing platform onboarding triggers, and offboarding audit trails all need durable, engineered workflows.Device trust is maturing. Okta Device Trust with Iru on macOS and Windows is live and expanding; we've seen why enrollment controls (not just access controls) matter.AI adoption is accelerating. Claude, Notion AI and agents, and n8n are in use. We need someone who can enable them quickly and safely, with scoped access, data-sensitivity controls, and governance.We have the platforms to automate. n8n (self-hosted), Okta Workflows, ticketing platform workflows/webhooks/API, and Notion databases are in place. We need someone who lives in them. What You'll Own1) Identity & access management (Okta-first)Own Okta as the control plane: SSO (SAML/OIDC), SCIM provisioning, group rules, profile/attribute mapping, authentication policies, MFA/FastPass, and admin role scopingDrive Okta to be the single source of provisioning for every eligible app; migrate remaining Rippling-provisioned apps and configure SCIM where supported but unusedDesign and maintain RBAC by department, role, and seniority; publish and maintain access control matricesBuild birthright access, time-bound access (e.g., international travel), and automatic revocationGovern service and shared accounts: inventory, ownership, conversion to named accounts, credential rotationRun recurring access reviews and produce audit-ready evidence for SOC 2 and security reviewsPartner with Security on zero-trust posture, device admission, geofencing, and Okta system log monitoring2) Automation, workflows & integrationsDesign, build, and maintain automations in n8n, Okta Workflows, and our ticketing platform, connecting Okta, Rippling, Ashby, the ticketing platform, Slack, Google Workspace, Notion, and business appsUse REST APIs, webhooks, OAuth/API tokens, and JSON payloads confidently; read vendor API docs and build reliable integrations with error handling, retries, logging, and alertingAutomate the employee lifecycle end to end: pre-hire prep, staged Okta creation and timed activation, Day-1 access, role/department changes, and offboarding with access revocation and audit trailPartner closely with HR / People Ops on lifecycle management: agree on HRIS data standards and trigger timing, coordinate start dates, role changes, leaves, and terminations (including sensitive or same-day exits), and handle HR data with discretionTurn access requests into self-service catalog items with approval routing by app sensitivity (Slack approve/deny, owner approvals, automatic provisioning on approval)Treat automations as production systems: version control or exportable definitions, documentation, runbooks, credential hygiene, least-privilege service accounts, and ownership3) Device management (macOS & Windows)Our fleet is roughly 85% macOS and 15% Windows. Mac is the default, but Windows users get the same level of support, security, and polish.Own MDM across macOS and Windows (Iru; experience with Kandji, Jamf, and/or Intune expected): enrollment (ABM/ADE, Autopilot), blueprints/profiles, compliance baselines, patching, app deployment, and FileVault/BitLockerMaintain and extend Okta Device Trust (device identity certificates, managed-device attestation, desktop and mobile auth policy rules)Harden enrollment controls so factors and devices can only be enrolled from managed, compliant hardwareOwn hardware lifecycle tooling and data: assignment, shipping, recovery, resale/disposal, and reconciliation with Finance4) IT operations & service excellenceServe as frontline support for Medely Help (our ticketing platform): identity, device, SaaS, and cross-system issuesHandle the occasional hands-on fix with care: password/MFA resets with proper identity verification, break/fix troubleshooting, and remote machine replacement (ship, wipe, re-enroll, recover)Own ticketing platform configuration: request catalog, forms, routing, categories, SLAs, inbox boundaries (privacy-aware for HR/sensitive queues), and AI triage behaviorMaintain a strong Helpdesk Knowledge Base and IT internal runbooks in NotionHelp build sustainable IT operating rhythms: roadmap hygiene, weekly status, ownership on every card, and visible deadlines5) Zoom & Zoom Phone administrationOwn Zoom Workplace administration: Okta SSO and SCIM provisioning, license types and assignment, roles, groups, account- and group-level settings and locks, and add-on managementManage meeting and recording policy: cloud recording settings, retention, sharing defaults, and access controls aligned with Security and LegalGovern Zoom AI Companion and other AI features: who has them, what's enabled, and how summaries and recordings are stored and sharedAdminister Zoom Phone end to end: number inventory and assignment, porting, call queues, auto receptionists/IVR, business hours and holiday routing, voicemail, and call handling for operational teamsOwn Zoom Phone compliance and reliability: emergency (E911) addresses, call recording policies and notices, SMS/10DLC registration, and call quality troubleshootingBuild Zoom and Zoom Phone into the employee lifecycle: automatic license and number assignment on hire, call queue and routing updates on role changes, and number reclamation, recording handoff, and license recovery on offboardingTrack Zoom usage and licenses to right-size seats and Zoom Phone plans at renewal6) Safe AI enablementEnable AI tools (Claude, Notion AI/agents, and new entrants) through Okta SSO/SCIM, group-based entitlements, usage controls, and approval workflowsBuild AI-assisted IT workflows (ticket triage, KB drafting, access request intake, reporting) with human-in-the-loop checkpoints where risk warrantsDesign, build, and maintain governed AI integrations using LLM APIs (Anthropic/OpenAI), MCP connectors, and AI agents (including Notion agents and n8n AI nodes), with scoped credentials, data boundaries, logging, and clear ownershipPut safeguards in place for every employee using AI tools: approved-tool list, data classification guidance (what never goes into a prompt: PII, PHI, credentials, customer data), connector and integration scoping, admin settings like data retention and training opt-outs, and audit loggingMake safe use the easy path: short, practical guidance and training in Notion, a clear request path for new AI tools, and fast reviews so people don't route around ITPartner with Security and Legal on AI acceptable-use policy, vendor reviews, and periodic checks of how AI tools are actually being used7) SaaS governance & shadow IT (Torii)Own Torii as the system for SaaS discovery: find unsanctioned apps, OAuth grants, and browser-extension sign-ups, and triage them (approve and bring under Okta, replace with a sanctioned tool, or shut down)Assign a business owner to every app and keep the SaaS inventory currentUse Torii usage for automated license reclamation and consolidationBuild automations off Torii signals (new app detected, unused licenses, upcoming renewals) into the ticketing platform, Slack, and Notion8) Security operations mindsetApply least privilege and zero-trust principles to every system you touch, including your own admin access and automation service accountsMonitor Okta System Log and admin activity; investigate suspicious sign-ins, unexpected factor enrollments, and policy failures with SecurityKeep secrets out of tickets, Slack, and workflows; use 1Password and scoped API tokens, and rotate credentialsAdminister 1Password: Okta-integrated provisioning, vaults and shared-vault structure by team, groups and permissions, policies, recovery and reportingSupport incident response: document, contain, and run post-incident follow-ups that close the underlying control gapHelp with security awareness for employees (phishing, MFA hygiene, device hygiene) and support Security on SOC 2 controls and evidence9) Systems & data architectureDesign clean, relational IT data in Notion (and connected sources): SaaS inventory and status, app ownership, access matrices, asset inventory, roadmap, and ticket insightsDefine sources of truth and sync patterns between HRIS (Rippling), identity (Okta), ticketing platform, and Notion so reporting is accurate and automatableBuild dashboards and metrics: ticket volume and categories, time to resolve, provisioning coverage, SCIM coverage, device compliance, license utilization, and SaaS spendSupport SaaS audits, renewals, and license reclamation with real usage data10) Notion platform ownershipAdminister Notion as a core company platform: teamspaces, permissions and sharing patterns, SCIM/SSO, databases, forms, automations, and AI agentsHelp departments build in Notion without oversharing or shadow IT; set standards and templates What success looks likeFirst 90 daysFully onboarded on Okta, Iru, the ticketing platform, n8n, and Notion admin; owns a defined set of IT Roadmap workstreams with weekly deadlines metDelivers a provisioning gap report: every app's SSO / SCIM / provisioning source / shared-account status, with a remediation planShips at least 2–3 production automations that measurably remove manual ticket work (e.g., top app access requests)Completes a Torii shadow-IT review: every discovered app is triaged, has an owner, and is either sanctioned under Okta or retiredAudits Zoom and Zoom Phone: license and number inventory, call queue and routing map, E911 addresses, and recording settings, with fixes for any gaps6 monthsOkta is the provisioning source for all eligible apps; Rippling-provisioned gaps closedAccess requests for top apps are self-service with policy-based approvals and auto-provisioningOnboarding/offboarding is triggered, timed, and audited end to endTicket deflection and time-to-resolve trend in the right direction, with a monthly ticket insights report12 monthsQuarterly access reviews are automated and audit-readyDevice compliance and device trust coverage near 100% across macOS and WindowsIT operational data (SaaS, access, assets, tickets) is trusted and powers dashboards and AI-assisted workflows Required Qualifications4+ years in IT operations / systems administration / IT engineering in a SaaS-first, remote companyDeep, hands-on Okta administration: SSO (SAML/OIDC), SCIM, group rules, attribute mapping, authentication policies, Device Trust, and Okta WorkflowsHands-on MDM for both macOS and Windows (Iru/Kandji, Jamf, and/or Intune), including ABM/ADE, Autopilot, compliance policies, and app deploymentGenuinely comfortable supporting both macOS and Windows. Our environment is about 85/15 Mac to Windows, so you need to be just as effective troubleshooting, hardening, and deploying on Windows as on MacMicrosoft 365 / Office 365 experience: licensing and app deployment (Word, Excel, PowerPoint, Outlook), Entra ID basics, coexistence with Google Workspace, and supporting Office apps on both macOS and WindowsProven experience building automations and integrations with n8n (strongly preferred), Okta Workflows, Zapier/Make, or Workato — using REST APIs, webhooks, and JSONCore competency: building with AI in a governed way. Hands-on experience building with LLM APIs (Anthropic/OpenAI), MCP connectors, and AI agents. You scope access to least privilege, protect sensitive data, keep a human in the loop where risk warrants, log what the AI does, and document how it worksStrong understanding of least privilege, RBAC, joiner/mover/leaver processes, and SOC 2–aligned IT controlsProven partnership with HR / People Ops on employee lifecycle management: onboarding, transfers, leaves, and offboarding, built on clear handoffs, shared data standards, and confidentialityHands-on 1Password admin experience (Business or Enterprise): provisioning, vault design, permissions, policies, account recovery, and shared-credential governanceA security-minded approach: comfortable reading auth logs, spotting risky configurations, and pushing back when convenience would weaken a controlExperience with SaaS management / shadow IT discovery (Torii, Productiv, Zluri, or similar)Google Workspace administration (groups, shared drives, security settings, data transfer)Hands-on Zoom and Zoom Phone administration: licensing, SSO/SCIM, meeting and recording policies, number management and porting, call queues, auto receptionists, routing, and E911Advanced experience administering ticketing platforms (Jira Service Management, Freshservice, Zendesk, Intercom, or similar): building and maintaining workflows, routing and assignment rules, request forms and catalogs, SLAs, queues, and integrationsTechnical translator, in both directions: able to explain complex technical solutions in plain English to executives, HR, Finance, and everyday users, and to turn vague business needs ("I just need it to work like this") into clear technical requirements, designs, and workflowsClear writer: produces runbooks, KB articles, and decision docs that technical and non-technical readers can both followReliable owner: keeps work visible, meets deadlines, raises blockers earlySelf-starter with a real appetite for technical growth: takes initiative without waiting to be asked, and has a track record of upskilling on their own, such as learning new platforms, earning certifications, building side projects, or picking up new tools like n8n, APIs, and AI CertificationsStrongly preferredOkta Certified ProfessionalOkta Certified Administrator (Okta Certified Consultant / Workflows a plus)Notion certification (Notion Admin / Notion Essentials or equivalent)Nice to haveApple Certified Support Professional / Apple Deployment and ManagementMicrosoft Endpoint Administrator (MD-102) or equivalent Intune certificationJamf or Kandji/Iru certificationGoogle Workspace Administrator certificationZoom Phone or Zoom Workplace admin training/certificationSecurity fundamentals (CompTIA Security+, or similar) Expectation: If not already Okta Certified, the hire completes Okta Professional and Administrator certification within the first 6 months (training available via our Okta Expert Learning Pass). Nice-to-have experienceIntercom experience**:** workspace administration, inboxes and teams, assignment and routing rules, workflows and bots, Fin AI, help center, and integrationsScripting: Python, JavaScript, Bash, or PowerShellRippling, Ashby, Torii (or similar SaaS management), Material Security, Slack admin/Workflow BuilderTouchpoints with GTM systems, especially Salesforce: user and license management, profiles and permission sets, Okta SSO/provisioning, connected apps and integration users, and sandbox accessFamiliarity with the broader GTM stack: Gong / Gong Engage, Salesloft, HubSpot, LeanData, ZoomInfo, Clay, Gainsight, Intercom, Segment, and Letter.AI (or similar sales engagement, routing, enrichment, and CS tools)Experience partnering with RevOps / GTM Systems on access bundles, onboarding and offboarding across GTM tools, integration and API token governance, and license true-upsBasic data modeling; building dashboards in Notion, Metabase, or TableauSupporting audits (SOC 2) with evidence collection How you workAutomate the second time: fix the ticket, then fix the system that caused itSecurity by default: least privilege, clean offboarding, scoped AI, no secrets in SlackDocumentation is part of done: if it isn't in Notion, it isn't finishedOwnership and visibility: every piece of work has an owner, a card, and a deadlineService-first: calm, clear, equal urgency for everyoneAlways leveling up: you spot what's next, teach yourself, and bring new skills back to the teamPlain English first: no jargon walls. If a stakeholder can't explain your solution back to you, it isn't communicated yet Core stack, including but not limited to:Okta (SSO, SCIM, Workflows, Device Trust) · Iru MDM (macOS & Windows) · Microsoft Intune · n8n · Ticketing platform (Medely Help) · Notion · Google Workspace · Microsoft 365 · Slack · Rippling · Ashby · Zoom Workplace & Zoom Phone · Material Security · 1Password · Torii · Claude / Anthropic · Delphina · Metabase / Tableau · Jira/Atlassian Why Medely: Benefits & PerksCompetitive Compensation: Based on experience and performanceLong-term Incentives: 401kHealthcare Benefits: Full suite of benefits including medical, dental, and vision insuranceFlexibility: We believe that work/life balance is important, so we offer twenty days of Paid Time Off and eleven paid holidays.Paid parental leavePurpose: Join a growing mission-oriented startup that is modernizing the healthcare industry nationally!Ownership: Drive meaningful business impact on a team you’ll help build and define!Remote: Work in a digital environment with all the tools to achieve your work as though you were in the office! We're an equal opportunity employer to all. We interview and hire applicants of all backgrounds, orientations, expressions, and identities. Work location is flexible if approved by Medely but you must be based in the US. Medely does not accept unsolicited resumes from agencies. We consider any resume (CV) or biography received from an agency or outside recruiter without prior approval from a member of the Medely Human Resources or Recruiting team to be unsolicited and gratuitous, and such submissions will not be recognized by Medely for purposes of “ownership” of the candidate. We are an E-Verify company.