Administrator, Systems

Berkeley Research Group•Washington DC, DC

2d•Hybrid

About The Position

Second Sight Solutions, a health technology company and subsidiary of Berkeley Research Group (BRG), is hiring a Systems Administrator (IAM Engineer) for its IT organization. This role owns the lifecycle, security, and governance of user identities and access in a Microsoft Entra ID-centered environment. The administrator works with the Security and IT Services teams to provide identity, endpoint, and systems support to employees and contractors in a Mac- and cloud-service-supported environment, including users across Second Sight’s global locations. The role administers identity lifecycle processes, authentication and access controls, access governance, audit readiness, and automation. It also supports Mac endpoint onboarding and offboarding, provides Tier 2/3 support for identity and access incidents, and coordinates IT projects, upgrades, migrations, and maintenance. Additional Mac and mobile device deployment, configuration, troubleshooting, and software support are performed as time allows. The position is based in Washington, DC, with partial remote work and in-office participation expected at least three days per week. Work shifts fall within core support hours of 8:00 a.m. to 8:00 p.m. local time, with coverage shared across the team. On-call work and overtime are required. Short periods of travel may be required, sometimes for five working days or longer on rare occasions; travel expenses are reimbursed. The salary range is $115,000–$125,000. Candidates must verify their legal right to work in the United States without company sponsorship.

Requirements

At least 3–4 years of IT experience in a similar capacity, including at least 2–3 years of hands-on IAM experience in a Microsoft Entra ID and Microsoft 365 environment.
Hands-on experience administering Microsoft Entra ID, including Conditional Access, MFA and passwordless authentication, enterprise applications and app registrations, single sign-on, group-based licensing, PIM, and access reviews.
Solid understanding of IAM concepts, including least privilege, role-based access control, segregation of duties, joiner/mover/leaver lifecycle management, Zero Trust, and authentication and federation standards such as SAML, OAuth 2.0, OpenID Connect, and SCIM.
Proficiency with PowerShell and Microsoft Graph API, or comparable scripting, to automate identity administration, reporting, and auditing.
Experience supporting access reviews, audits, compliance assessments, or client security assessments, and producing clear evidence and documentation.
Hands-on experience with Microsoft Intune device management; Intune is required.
Ability to deploy, configure, and manage Apple devices and BYOD phones at scale.
Understanding of IT security principles and privacy practices as applied to Apple environments, including encryption, MFA, and secure device management.
Experience with IT service management ticketing software such as Jira.
Strong knowledge of technology, hardware, and software in a professional services environment, including MacOS, desktop and network security, software functionality and deployment, and Microsoft Office 365.
VIP customer satisfaction focus, strong customer service and interpersonal skills, and effective speaking, writing, and active listening skills.
Positive and professional attitude, with the integrity and discretion to handle privileged access and sensitive personal and client data.
Ability to solve complex problems by gathering facts and applying detailed troubleshooting techniques; keen attention to detail and critical thinking skills.
Good organization, time management, and prioritization; ability to multitask and balance workload with project assignments.
Experience managing IT projects, including hardware and software rollouts, system upgrades, and migrations.
General working knowledge of networking fundamentals, including TCP/IP, DNS, routing, and subnetting, as well as antivirus, backup, and remote access technologies.
Ability to verify legal authorization to work in the United States without company sponsorship.
Ability to work a shift within the 8:00 a.m.–8:00 p.m. local support window, participate in on-call coverage and overtime, and travel for short periods when required.
Ability to work in a hybrid arrangement based in Washington, DC, with in-office participation expected at least three days per week.

Nice To Haves

Experience with Jamf.
Microsoft Certified: Identity and Access Administrator Associate (SC-300) or equivalent Microsoft security certification.
CompTIA Security+ or similar security certification.
Apple Certified Support Professional (ACSP), Apple Certified Mac Technician (ACMT), or similar Apple technology credential.
ITIL 4 Foundation certification.
CompTIA A+ certification.

Responsibilities

Own the joiner, mover, and leaver identity lifecycle for employees and contractors in Microsoft Entra ID, including provisioning, role and group changes, and timely access revocation.
Administer Entra ID users, security and Microsoft 365 groups, guest accounts, device registrations, naming and attribute standards, and group-based licensing.
Manage application access, including single sign-on integrations using SAML or OIDC, enterprise applications and app registrations, and SCIM provisioning where supported.
Coordinate with GRC, HR, managers, and application owners to define role-based access models and approve, fulfill, and document access requests.
Design, implement, and maintain Conditional Access policies, using documented testing and change management.
Manage MFA and passwordless authentication, self-service password reset, and authentication method policies.
Administer privileged access using least privilege, role-based access control, PIM just-in-time elevation, separate administrator accounts, and emergency account procedures.
Monitor sign-in and audit logs and identity risk signals; work with Security Operations to investigate and remediate suspicious activity and identity-related findings.
Plan and conduct periodic access reviews and recertifications for users, groups, applications, and privileged roles; follow up on remediation and retain audit evidence.
Audit access for policy compliance and identify excessive or orphaned permissions, stale accounts, and potential security risks.
Support internal and external audits and client security assessments with identity and access evidence, documentation, and reporting.
Develop and maintain IAM standards, procedures, runbooks, and metrics, and deliver employee training on secure authentication and access practices.
Automate identity lifecycle, reporting, and routine administration tasks using PowerShell, Microsoft Graph, Entra lifecycle workflows, and similar tools.
Integrate Entra ID with HR sources, help desk and ticketing software, endpoint management, and SaaS applications to streamline access requests and approvals.
Research identity, authentication, and access governance capabilities and recommend improvements.
Manage MacBooks returned to the DC office during offboarding, including inventorying and preparing devices for shipment to other endpoint specialists.
Assist with MacOS user onboarding and offboarding, including device setup and access revocation.
Provide Tier 2/3 support for identity and access incidents, including account lockouts, MFA enrollment and recovery, and application access issues.
Support Mac devices in coordination with identity controls, including device compliance, FileVault, and Jamf/Intune integration with Entra Conditional Access and macOS single sign-on.
As time allows, deploy, maintain, and troubleshoot MacBooks and mobile devices remotely and onsite; manage standardized workstation configurations, software updates, and patches with minimal disruption.
As time allows, troubleshoot MacOS issues and interactions with Microsoft 365, Jamf, FileVault, endpoint security software, and commercial software applications such as Office 365, Adobe, and Intune.
Share duties with other Second Sight IT personnel and coordinate project actions with the IT Services Manager, system administrators, vendors, technical representatives, and internal and external clients.
Coordinate IT project teams and schedule and organize upgrades, migrations, and maintenance.
Perform additional tasks as directed by the IT Services Manager.
Provide support to clients and personnel across Second Sight locations globally, including remote personnel and independent contractors; travel for short periods when required.