Manager, IT & Information Security

ClarityPay•New York, NY

18h•$130,000 - $170,000•Onsite

About The Position

ClarityPay is redefining the point-of-sale credit market to bring more value to merchants. Based in NYC and Atlanta, our fast-growing fintech empowers large merchants with configurable “Pay-Over-Time” tools— including monthly installments, BNPL, and revolving products. We solve complex credit challenges with speed, precision, and intelligence—combining deep expertise with advanced tech to deliver better outcomes, every time. Our clients rely on us to help them serve their customers, grow, and build loyalty. Our values guide everything we do: we put merchants first, stay data-driven, always know the why, learn relentlessly, and win together as a team. This clarity of purpose fuels our commitment to delivering exceptional customer experiences at speed and scale. ClarityPay is seeking a Manager of Information Technology & Information Security to build and run the technology backbone of the company. This is our dedicated IT and security hire, and it is a hands-on, build-it-yourself role: you will personally provision laptops, administer our SaaS stack, grant and revoke access, and answer the help request — while also standing up the policies, controls, and vendor relationships a regulated fintech needs as it scales. You will own corporate IT, identity and access management, endpoint and email security, incident response, and business systems administration, and you will be the internal owner of the evidence and controls that support our SOC 2, PCI DSS, and partner-bank security reviews. Today this work is spread across the executive team; your first mandate is to consolidate it, document it, and make it reliable. This is an on-site role based in our New York office, with a minimum of four days per week in the office. This role collaborates closely with Engineering, Data, Operations, Risk, Compliance, Legal, Finance, and People, and offers a clear path to grow into leading a small team as the company scales.

Requirements

Curious, energetic, positive, solution-oriented, collaborative, trusted.
5+ years of progressive experience in IT operations, systems administration, and information security, including hands-on ownership of endpoints, identity, and corporate systems.
Experience as the primary IT and security owner at a company, or as the senior individual contributor on a small team — comfortable being both the strategy and the execution, with no team to delegate to on day one.
Hands-on expertise with identity and endpoint tooling: SSO/IdP (e.g., Entra ID/Azure AD, Okta), MFA, MDM (e.g., Intune, Jamf, Kandji), and EDR.
Strong Microsoft 365 administration skills, including Exchange, Entra ID, and security and compliance configuration.
Practical experience supporting SOC 2 and/or PCI DSS audits — building controls, gathering evidence, and closing findings.
Working knowledge of security frameworks and regulatory expectations relevant to financial services (e.g., NIST CSF, CIS Controls, GLBA safeguards) and of partner-bank or vendor security review processes.
Experience in fintech, banking, lending, payments, or another regulated environment strongly preferred.
Demonstrated success in early-stage or high-growth environments, helping shape strategy and systems while collaborating across teams to solve complex challenges.
Scripting and automation ability (e.g., PowerShell, Python) to eliminate manual, repeatable work.
Exceptional communication skills, with the ability to explain technical risk and trade-offs to a non-technical executive audience.
Comfortable leveraging AI tools and emerging technologies to improve productivity, analysis, and decision-making.
Able to work independently following established guidelines, exercise sound judgment under pressure, and respond to urgent issues outside standard business hours when needed.
Based in the New York metropolitan area and able to work on-site in our New York office a minimum of four days per week to support employees, equipment, and the office environment; occasional travel to the Atlanta office (up to 10%).

Nice To Haves

Security certifications a plus (e.g., CISSP, CISM, Security+, SSCP, Microsoft or Okta administrator certifications).

Responsibilities

Own end-to-end IT operations for the company: laptop and device procurement, imaging, deployment, inventory, refresh, and secure decommissioning across the New York and Atlanta offices and remote staff.
Own identity and access management: provision and de-provision accounts, administer SSO and MFA, enforce least-privilege and role-based access, and run periodic access reviews with documented evidence.
Administer the corporate SaaS and business systems stack (e.g., Microsoft 365 and email, Slack, Retool, HRIS, e-signature, and the productivity and AI tools employees rely on), including configuration, integrations, and license and spend management. Production and cloud infrastructure remain owned by Engineering; you partner with them on shared controls.
Create, secure, and manage corporate email — accounts, distribution lists, aliases, shared mailboxes, domain records (SPF, DKIM, DMARC), and anti-phishing and data-loss controls.
Own endpoint security: MDM enrollment, disk encryption, patch and vulnerability management, EDR/antivirus, and configuration baselines for every company device.
Run the day-to-day help desk with clear SLAs — triage, resolve, and escalate employee requests, and track recurring issues to root cause rather than repeat fixes.
Own new-hire onboarding and offboarding from an IT and security standpoint: day-one readiness (device, accounts, access, training) and same-day access removal at exit, coordinated with People and hiring managers.
Serve as the internal owner of information security operations: security monitoring and alerting, incident detection and response, tabletop exercises, and post-incident reviews.
Produce and maintain the controls, documentation, and audit evidence supporting SOC 2, PCI DSS, and partner-bank and merchant security reviews, partnering with Risk, Compliance, and Legal, who own the frameworks and auditor relationships.
Lead third-party and vendor security reviews and due diligence, and maintain the vendor inventory and associated risk documentation.
Author and maintain IT and security policies, standards, and runbooks (acceptable use, access control, device, password and credential management, incident response, business continuity and disaster recovery), and deliver recurring employee security awareness and phishing training.
Manage office and network infrastructure — connectivity, Wi-Fi, conference room and AV technology, printers, and physical access systems — for the New York office and support Atlanta remotely.
Own vendor and MSP relationships, contracts, and renewals for IT and security tooling; forecast and manage the IT budget and drive cost efficiency as headcount grows.
Build a scalable IT and security roadmap: identify the gaps, prioritize them by risk and effort, and sequence the work so controls mature ahead of growth rather than behind it.
Enable safe adoption of AI and emerging technologies — evaluate tools, set usage and data-handling guardrails, and help teams use them to work faster without creating exposure.
Report on IT and security posture, incidents, and key metrics to executive stakeholders in clear, non-technical terms.
Perform other duties and/or special projects as assigned.
Continually promote and apply ClarityPay values; be a role model of trust and integrity.