IT Administrator

SunCore Digital•London, Arizona

3h•$90,000 - $150,000•Remote

About The Position

SunCore Digital is seeking an IT Administrator to build and operate the company’s internal technology foundation as it grows. The role begins by establishing corporate IT from the ground up and then owning identity and access, Microsoft 365, endpoint management and security, SaaS administration, and IT operations. Production infrastructure, cloud environments, and deployment pipelines are owned by Engineering; this position is responsible for corporate IT. The IT Administrator will own the Microsoft 365 tenant and Microsoft Entra ID as the company’s single identity provider, company-managed endpoints, and employee business applications. The role is the primary point of contact for internal technology operations, including account provisioning, device management, access controls, security enforcement, SaaS administration, and end-user support. The administrator will work with Engineering, Security, Human Resources, and Leadership to maintain compliance, strengthen security, and support company growth. This is a hands-on role requiring technical problem-solving, strong documentation practices, and a proactive approach to reliability and security. It is remote-first. Compensation is deferred until 60 days after MVP launch, with equity, bonuses, and annual offsite perks also noted.

Requirements

At least 5 years of experience in Information Technology, Systems Administration, or IT Support, including experience building or substantially rebuilding at least one environment rather than inheriting it.
Strong hands-on experience administering Microsoft 365 and Microsoft Entra ID, including Exchange Online, SharePoint, and OneDrive.
Experience designing and operating identity and access management, including SSO federation, MFA, Conditional Access, role-based access, and privileged access management.
Hands-on experience deploying and administering Microsoft Intune or an equivalent MDM platform for both Windows and macOS, including zero-touch enrollment.
Hands-on experience deploying and operating endpoint protection and EDR platforms by policy across a fleet.
Experience with endpoint patch management and vulnerability management.
Experience configuring email authentication (SPF, DKIM, DMARC) and email threat protection.
Proficiency with PowerShell for Microsoft 365 and Entra ID administration and automation.
Understanding of networking fundamentals, DNS, domain and certificate management, and identity-based access controls for a remote-first workforce.
Familiarity with compliance and security frameworks such as SOC 2, ISO 27001, or similar standards, including producing audit evidence.
Strong troubleshooting and problem-solving skills, including the ability to diagnose issues independently.
Experience documenting processes and maintaining accurate system records.
Excellent communication skills and ability to support technical and non-technical users.
Ability to prioritize multiple requests while maintaining attention to detail.
At application, candidates must hold at least one listed Microsoft administration certification: Microsoft 365 Certified: Endpoint Administrator Associate (MD-102); Microsoft Certified: Identity and Access Administrator Associate (SC-300); Microsoft 365 Certified: AI Services Administrator Associate (AB-650); or Microsoft 365 Certified: Administrator Expert (MS-102), accepted from current holders only.
At application, candidates must hold at least one listed security certification: CompTIA Security+; Microsoft Certified: Information Security Administrator Associate (SC-401); or Microsoft Certified: Security Operations Analyst Associate (SC-200).

Nice To Haves

Experience working in startups, remote-first organizations, fintech environments, or blockchain-related industries.
Experience with compliance automation platforms, SIEM or log analytics tools, password manager administration, and Jamf.
A second certification from either required certification list; MD-102 and SC-300 together cover the endpoint and identity scope of the role.
CompTIA Network+.
ITIL 4 Foundation.
Apple Certified IT Professional or an equivalent macOS device management certification.

Responsibilities

Own the Microsoft 365 tenant and Microsoft Entra ID as the company’s single identity provider.
Manage the user lifecycle, including account creation, licensing, role and permission assignment, timely deactivation, and documented onboarding and offboarding checklists.
Execute same-day offboarding after notice by blocking sign-in, revoking sessions, reassigning mailbox and file ownership, removing SaaS access, and wiping company data from devices.
Implement and maintain least-privilege administration, role-based access, just-in-time privileged access, and monitored break-glass accounts.
Enforce MFA, block legacy authentication, and maintain Conditional Access policies that require compliant devices to access company data.
Federate SSO to SaaS applications and implement automated provisioning and deprovisioning where supported.
Administer Exchange Online, including mailboxes, shared mailboxes, distribution groups, mail flow rules, and retention.
Configure and enforce SPF, DKIM, and DMARC for company sending domains.
Manage email threat protection, including Safe Links, Safe Attachments, anti-phishing and impersonation protection, and external sender tagging.
Manage SharePoint and OneDrive sharing policies, data loss prevention rules, and third-party Microsoft 365 data backup.
Stand up and administer Microsoft Intune for Windows and macOS, including zero-touch enrollment through Windows Autopilot and Apple Business Manager.
Define and enforce device compliance policies for disk encryption, screen lock, operating system patch currency, host firewall, and removal of local administrator rights.
Deploy and manage antivirus and endpoint detection and response on devices through Intune, tying device compliance to Conditional Access.
Manage operating system and third-party application patching, including update rings and reporting.
Maintain hardware and software inventory, asset tracking, and device lifecycle processes, including shipping, returns, and lost or stolen device procedures.
Administer Slack, Zoom, HRIS platforms, and other SaaS applications, including SSO enforcement, guest access, and retention settings.
Maintain a SaaS inventory with a named administrative owner for each application and identify unsanctioned applications.
Deploy and administer a company password manager.
Coordinate with vendors and service providers on subscriptions, licensing, renewals, and support agreements.
Monitor identity, audit, and endpoint security logs for risky sign-ins, unauthorized access attempts, administrative changes, and configuration drift.
Own technical controls supporting SOC 2, including access reviews, device compliance, encryption, offboarding evidence, and IT systems change records.
Conduct and document quarterly access reviews across company systems.
Maintain and execute account compromise and lost device response runbooks.
Run security awareness training and phishing simulations.
Support disaster recovery, backup verification, and business continuity processes.
Report technology risks, incidents, and infrastructure status directly to leadership.
Serve as the primary escalation point for employee technical support requests.
Create and maintain IT policies, procedures, knowledge base articles, and system documentation.
Recommend operational improvements that increase efficiency, security, and scalability.