IT Operations Lead

Blackpoint Cyber • ,

22h • $131,000 - $163,000

About The Position

Blackpoint Cyber is hiring an IT Operations Lead to translate strategy set by the CSTO into delivered IT work and serve as the company’s in-house Microsoft expert. The role owns the architecture, security posture, and automation of Microsoft Entra ID, establishes technical standards for Intune, Jamf, and SaaS integrations, and serves as the final technical escalation point for identity, endpoint, and SaaS incidents.

This is a hands-on player-coach position intended for an established senior engineer growing into leadership. The lead is expected to spend most of their time working directly in technology while directing and mentoring the IT Administrator and other IT staff, planning and prioritizing work, and documenting architecture and operating standards. The role supports approximately 230 team members across a distributed workforce.

The position spans identity and access management, endpoint and SaaS governance, security and compliance controls, IT workflows and automation, business-system integrations, vendor relationships, and support for Product and Engineering environments. It also supports deployment of the Blackpoint agent through Datto RMM and builds auditable automation for repeatable IT processes.

Requirements

• 7 to 10+ years in systems engineering, identity engineering, or senior IT infrastructure.
• At least 4 years of deep, hands-on Microsoft Entra ID experience in a production tenant.
• Expert-level skill with Conditional Access, PIM, authentication methods, app registrations and enterprise applications, and SAML/OIDC federation.
• Hands-on experience with Entra ID P2 capabilities, including Identity Protection, access reviews, and entitlement management.
• Strong Microsoft Graph API and PowerShell automation skills.
• Working knowledge of KQL and sign-in and audit-log analysis, and familiarity with identity threat detection concepts.
• Broad Microsoft platform expertise, including Microsoft 365 administration, Defender, and Azure fundamentals.
• Experience implementing and evidencing technical controls for a compliance framework such as CMMC Level 2, NIST 800-171 or 800-53, SOC 2, or ISO 27001.
• Experience administering Jira, Jira Service Management, and Confluence, and building workflows with Power Automate or similar tools.
• Experience managing Intune at fleet scale.
• Experience integrating SSO and identity providers beyond Entra and using SCIM-based provisioning.
• Proven ability to execute against a defined strategy through planning, project delivery, and cross-functional work.
• A strong, verifiable record of hands-on delivery as an established senior engineer; formal people-management experience is not required.
• Informal leadership experience such as mentoring, leading projects, or serving as a go-to escalation point.
• Motivation to grow into management while remaining close to technical work.
• Clear written communication skills and the ability to document decisions and designs well.

Nice To Haves

• Microsoft SC-300, MS-102, AZ-500, or SC-200 certification; at least one is strongly preferred.
• Experience in a security vendor or MSP, or in a CMMC, FedRAMP, or federal-contracting environment.
• Infrastructure-as-code or configuration-as-code experience for Entra and Intune, such as Microsoft365DSC or Terraform.
• Experience with Jamf and macOS management.
• Experience with Datto RMM or another RMM platform.
• Experience with Auth0.
• Python or Bash automation skills.

Responsibilities

• Translate strategy and priorities into projects and tasks; sequence and assign work, run weekly planning, track progress, remove blockers, and report status and risks to the CSTO.
• Set daily priorities for the IT Administrator and other IT staff, review changes, coach team members, and create architecture documentation, runbooks, and change standards.
• Serve as the final technical escalation point for identity, endpoint, and SaaS incidents; conduct root cause analysis and drive permanent fixes.
• Implement platform and tooling decisions made by leadership, including feasibility and effort estimates and vendor and licensing tasks.
• Own Entra ID architecture and privileged access, including Conditional Access, authentication methods, passwordless and phishing-resistant MFA, PIM, admin role hygiene, break-glass accounts, and delegated administration.
• Govern identity lifecycle processes using Entra ID P2 capabilities, including access reviews, entitlement management, Identity Protection, and automated joiner, mover, leaver, onboarding, and offboarding flows.
• Manage SSO and application integrations, app registrations, enterprise applications, SAML and OIDC federation, and SCIM provisioning across Entra and Auth0.
• Own device identity, including Entra join and registration, Platform SSO and Entra sign-in on macOS, and the relationship between device identity, Intune compliance, and Conditional Access.
• Govern guest, contractor, agency, and vendor access in Entra and Microsoft 365, including time-bound access, sponsorship, and external partner SFTP or website access.
• Maintain an access role matrix, pre-approved role-based access bundles, and an approval matrix so routine requests can be handled by the IT Administrator.
• Implement and evidence IT technical controls for CMMC Level 2, including MFA and lockout policy, MDM and endpoint baselines, removable media controls, least privilege, backup configurations, audit-log alerting, remote access, patch management, system inventory, and network diagrams.
• Support SOC 2 Type 2 and policy governance by remediating access-related findings, conducting periodic user access and firewall configuration reviews, reviewing technical accuracy of security policies, and reviewing vendor intake requests from the IT perspective.
• Remediate security findings on corporate systems and web properties in partnership with Marketing, Web, and Security.
• Partner with Security on identity threat detection by monitoring sign-in and audit logs, tuning risk policies, responding to identity incidents, writing KQL for dashboards and detections, responding to audit-log requests, and owning compliance reporting.
• Set architecture, configuration baselines, compliance policies, and security policies for Intune, Jamf, and Datto RMM, and integration standards for Microsoft 365, Google Workspace, Slack, and Zoom.
• Administer Jira, Jira Service Management, and Confluence, including IT service workflows, and own Power Automate flows supporting IT processes, their failure alerting, and runbooks.
• Set usage policy, seat and quota approval criteria, and security review for AI tools including Claude, Claude Code, and Cursor; manage team and admin ownership, connectors, and MCP servers.
• Lead the IT side of business-system integrations and enterprise app provisioning, including Salesforce, the HR system, compliance platform and Intune integration, telephony and sales tooling reviews, and apps supporting Engineering and SOC repositories.
• Define how access to AWS, Azure, VPN, and engineering tools is requested, approved, and granted in coordination with SRE and Security.
• Manage corporate network and office infrastructure vendor relationships and renewals, and maintain the system inventory and renewal calendar.
• Serve as the company’s Microsoft subject-matter expert across Entra ID, Microsoft 365, Intune, Defender, and Azure fundamentals.
• Own IT support for Product and Engineering environments, including Mac and Windows labs, integration labs, VDI environments, test tenants, dogfooding setups, engineering onboarding, and reproducing customer-style Microsoft 365 and Entra scenarios.
• Support deployment of the Blackpoint agent through Datto RMM by maintaining installer guides, scripts, and the ComStore component for the Unified Agent, and providing technical escalation support.
• Build and maintain auditable, source-controlled automation using Microsoft Graph, PowerShell, Power Automate, and Python for provisioning, offboarding, license assignment, group governance, and reporting.

Benefits

• Competitive health insurance plans for eligible US employees.
• Vision insurance for eligible US employees.
• Dental insurance for eligible US employees.
• Life insurance for eligible US employees.
• Robust 401(k) plan for eligible US employees.
• Discretionary Time Off for eligible US employees.
• Equity participation available to employees globally, with program details varying by location and employment structure.
• International employees receive benefits in accordance with local market standards and applicable country requirements.
• Other minor perks.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed