IT Operations & Security Lead (Remote - US CT/ET)

Zen Educate•Chicago, IL

11d•$110,000 - $120,000•Remote

About The Position

Zen Educate is seeking an IT Operations & Security Lead to own the company's internal IT systems and security as the organization grows. This role reports directly to the Chief Technology Officer and is the first dedicated hire for this function, replacing responsibilities previously spread across multiple roles. The ideal candidate will execute modern IT and security practices, including automation, governance, and AI adoption, with the goal of establishing a clear, proportionate, defensible, and scalable IT and security posture. The focus is on fixing immediate issues while implementing long-term solutions to prevent recurrence, moving away from manual ticket clearing and account provisioning towards systemic improvements.

Requirements

Experience in a similar role, potentially as one of the first IT, Corporate IT, or Security Operations team members in a growing company.
Proven experience in improving IT and security processes from manual or poorly defined states to scalable solutions.
Hands-on depth in identity and access management.
Hands-on depth in endpoint management.
Hands-on depth in automation.
Working grasp of SaaS governance.
Working grasp of vendor and license management.
Working grasp of audits and certification.
Working grasp of incident response.
Working grasp of data protection.
Understanding of security principles and why controls work, enabling adaptation to new systems.
Business-minded approach to applying security in proportion to the company's current stage.
Ability to identify which risks truly matter to the company.
Strong communication skills, including the ability to communicate confidently at all levels of the business.
Ability to work independently and own outcomes.
Experience with modern IT and security practices, including automation, governance, and AI adoption.
Experience managing device fleets, including security, patching, encryption, and provisioning.
Understanding of "least privilege" as a security principle.
Experience with Google Workspace, SSO, and MFA.

Nice To Haves

Experience building IT and security systems from scratch.
Experience with AI adoption in IT and security.
Experience with Cyber Essentials certification.
Experience with remote device management for both company-owned and personal devices.

Responsibilities

Own internal IT systems and security as the company grows.
Execute modern IT and security practices, including automation, governance, and AI adoption.
Establish a clear, proportionate, defensible, and scalable IT and security posture.
Improve the process for granting access to systems, aiming to build workflows that eliminate manual checklists.
Own internal identity and access management, including Google Workspace, SSO, MFA, groups, and permissions, adhering to the principle of "least privilege".
Ensure access follows employees as they join, move, and leave the company.
Build a definitive view of the company's software and service estate (what is used, who owns it, who has access, costs, renewal dates).
Work with teams and vendors to improve the procurement, renewal, and retirement of software tools.
Define and maintain IT and security policies, translating them into practical processes, technical controls, and effective training.
Implement and manage access reviews, vulnerability management, external testing, incident processes, and a system for reporting concerns.
Provide evidence for customer requests regarding security, including security questionnaires, audit evidence, and support for certifications like Cyber Essentials.
Build a reusable, increasingly self-service trust process for security and compliance.
Work closely with Legal and Data Protection advisors on security and privacy matters.
Set up and provision devices securely and remotely, managing both company-owned and personal devices.
Ensure devices are secure, patched, encrypted, and accounted for, regardless of location.
Respond effectively to incidents, ensuring clear ownership, good communication, recorded decisions, and resolution of underlying issues.
Extend the established incident process to all internal IT and security matters.