IT Systems Engineer

About the role

At Thatch, technology is how our teams get their work done, securely and without friction. As our IT Ops/Systems Engineer, you'll own the systems and access infrastructure that keeps the company running: endpoint compliance, identity and access management, and the operational backbone behind our security initiatives. This role goes beyond day-to-day support. You'll be the owner of company-wide compliance, conditional access and privileged access workflows in a Mac-first environment, with the autonomy to build the systems and automation that let us scale securely. If you want real ownership over how a fast-growing technology company manages access and identity, this role is for you.

Responsibilities

• Own our technology stack including Okta, Iru, Mac, iOS, Android, Rippling MDM/SSO, 1Password, Google Workspace, Microsoft Office, Slack, Zoom, Linear, and Notion
• Drive endpoint fleet compliance to 100% coverage across MDM, EDR, and DLP, and own remediation when devices fall out of compliance
• Administer conditional access policies (device trust, managed browser enforcement) and own the exception and escalation process when legitimate access gets blocked
• Own the Privileged Access Management (PAM) workflow, including replacing manual quarterly access reviews with automated request, approval, and time-bound removal
• Run trusted device and MFA enrollment, and lead remediation campaigns for weak or breached passwords
• Own the complete employee lifecycle experience from onboarding through offboarding, managing access control, hardware provisioning, and audit-ready documentation
• Vet and administer new SaaS tooling for SSO/IdP compliance as part of vendor onboarding, expose and remediate shadow IT
• Build and maintain a knowledge base that empowers employees to solve common issues independently
• Identify and build automation for repetitive IT and access-management tasks
• Partner with the Head of IT and Security to support company-wide initiatives and maintain our security posture

Requirements

• 4-6 years of hands-on IT support or systems engineering experience in a corporate environment, ideally including some ownership of identity/access infrastructure
• Certification in Network+, Security+, JAMF, Bettercloud, Okta, or comparable credentials
• Deep understanding of SSO, 2FA, passkeys, conditional access, and password management systems
• Experience administering or implementing a PAM tool, or a clear grasp of the concepts and willingness to build one from scratch
• Strong knowledge of security principles and best practices with proven ability to implement them at scale
• Excellent follow-through and organizational skills. You never let tasks fall through the cracks

Skills

• Experience driving a fleet from partial to full MDM/EDR/DLP compliance, and building the exception workflow that kept support ticket volume manageable
• Self-motivated individuals who can work independently with minimal supervision and take ownership of projects from start to finish
• Quick learners who can master new technologies with minimal guidance
• Patient communicators with flexible, inclusive interpersonal skills who genuinely enjoy helping others
• Problem-solvers who are resilient in learning from mistakes and view technical challenges as opportunities
• People who thrive in fast-paced environments and can adapt quickly to changing priorities

Pay

Estimated Compensation Range $145,000—$158,000 USD