Corporate IT Lead

Polanov Tech; São Paulo; Hybrid; BRL 172,000 - 187,000; Full time

Job summary

Polanov Tech is seeking aSenior Corporate IT Lead to own the SOC 2 program, IT service delivery, and security for a remote workforce across the US, UK/Europe, and South America. You will drive governance, engage with external auditors, and partner with MSPs and vendors to ensure a credible, sustainable program.

You will balance security with employee experience and cost while delivering end-to-end ownership of corporate IT operations and systems governance.

Qualifications

• Experience owning or substantially leading a SOC 2 program.
• Ability to connect SOC 2 to customer trust and business goals.
• Experience managing external auditors and remediation.
• Ability to assess risk and make independent decisions.
• Experience delegating to MSPs and vendors.
• 5+ years in IT operations or a large corporate function.
• Comfort delivering through MSPs and contractors without direct reports.
• Knowledge of Microsoft 365, Entra ID, IAM, and endpoint governance.

Responsibilities

• Own SOC 2 program end-to-end, including audit readiness and remediation.
• Develop and drive a corporate IT roadmap with business leaders.
• Balance security with usability, cost, and maintainability.
• Manage MSPs and contractors with clear governance and SLAs.
• Oversee identity and access management and end-user provisioning.
• Maintain governance of SaaS inventory, licensing, and access.

Skills

Independent judgment

MSP management

Vendor management

Lean environment

Solo contributor

International collaboration

Tools

Microsoft 365

Entra ID

SSO

MFA

CRM governance

MDM

Job description

Remote | Senior Individual Contributor | Reports to the SVP of Engineering

Rate: USD 23–25

Must-haves

• End-to-end SOC 2 ownership: Experience owning or substantially leading an internal SOC 2 program, with accountability for decisions and outcomes.
• Business understanding of SOC 2: Ability to explain its purpose, connect it to customer trust and commercial needs, and translate those objectives into practical controls.
• External auditor relationship: Experience directly managing or materially leading auditor engagement, including discussions about scope, controls, evidence, findings, and remediation.
• Independent judgment: Ability to assess risk, challenge assumptions, recommend solutions, and make sound decisions without step-by-step direction.
• MSP and vendor management: Proven ability to delegate execution, define service expectations, and hold providers accountable.
• Lean-environment ownership: 5+ years of relevant IT experience, including accountable ownership of corporate IT operations or a substantial part of the function.
• Solo contributor operating model: Comfort delivering through MSPs, contractors, and vendors, with no direct reports or mandate to build an internal team.
• Technical foundation: Working knowledge of Microsoft 365, Entra ID, identity and access management, SaaS governance, and Windows and macOS endpoint management.
• International collaboration: Availability to collaborate across US and UK/European working hours and travel to the United Kingdom approximately 1–2 times per year.

Experience limited to external auditing, evidence collection, or implementing controls designed by others is insufficient on its own. Candidates must demonstrate thoughtful program ownership and business judgment.

• SOC 2 program strategy, scope, control design, audit readiness, and remediation.
• Risk assessment and prioritization.
• Auditor and cross-functional stakeholder management.
• Corporate IT strategy and systems governance.
• MSP oversight, service delivery, and vendor accountability.
• Identity and access management: SSO, MFA, privileged access, and joiner/mover/leaver processes.
• Microsoft 365 and Entra ID.
• Windows and macOS endpoint governance.
• SaaS inventory, licensing, access controls, and cost management.
• Corporate security and incident response.
• Information management, policy development, and documentation.
• AI governance and evaluation of data-handling risks.
• Clear communication, autonomous decision-making, and effective delegation.

About the role

Our client is looking for a Corporate IT Lead to own its corporate technology environment, IT service delivery, security, and SOC 2 program.

This is a high-autonomy role for someone who combines technical understanding with business judgment. You will identify what the organization needs, recommend practical approaches, make sound decisions, and drive outcomes through managed service providers, specialist contractors, vendors, and internal stakeholders.

A central responsibility is end-to-end ownership of SOC 2. Our client needs someone who understands why a company pursues SOC 2, how it supports customer trust and commercial requirements, and how to translate those objectives into a credible, sustainable program. You should be comfortable making decisions about scope, control design, accountability, and remediation, as well as managing the relationship with external auditors.

This is a solo, senior individual contributor role with no direct reports. The operating model scales through effective delegation, clear governance, and strong vendor accountability. Success means building a reliable corporate IT function through these partners.

Our client is a remote-only company with employees across the United States, United Kingdom, South America, and Europe. MSPs and specialist contractors deliver much of the endpoint management, hardware logistics, and technical support. You remain accountable for the quality, security, and effectiveness of those services.

What you will own

SOC 2 program ownership and business alignment

• Own the client’s SOC 2 program end-to-end, including program planning, audit readiness, the external auditor relationship, control-owner coordination, remediation, and ongoing improvement.
• Understand the business purpose of SOC 2 and connect program decisions to customer expectations, commercial needs, organizational risk, and operational realities.
• Lead decisions and recommendations on audit scope, control design, and implementation, involving the appropriate business and technical owners.
• Serve as the primary point of contact for external auditors, managing expectations, timelines, requests, and discussions about how controls address risk.
• Establish clear control ownership across the company and ensure stakeholders understand their responsibilities and the reasoning behind them.
• Evaluate whether controls are appropriate, effective, and sustainable, and improve approaches that create unnecessary effort or fail to address the underlying risk.
• Oversee control operation, evidence production, and remediation while ensuring these activities support a coherent program.
• Assess findings, prioritize remediation, and communicate business implications and tradeoffs to leadership.
• Build compliance into everyday operations so the organization can maintain readiness throughout the year.

Corporate IT strategy and systems governance

• Develop and drive a practical corporate IT roadmap in partnership with the SVP of Engineering and other company leaders.
• Proactively identify risks, inefficiencies, and opportunities, and bring forward recommendations with clear business rationale.
• Balance security, employee experience, cost, maintainability, and business priorities when making decisions.
• Maintain a clear understanding of major corporate systems, integrations, systems of record, ownership, dependencies, and information flows.
• Address unnecessary application duplication, weak ownership, poor integrations, and avoidable cost.
• Own SaaS governance, including application inventory, access controls, licensing, renewals, rationalization, and evaluation of new tools.
• Oversee the contractor responsible for CRM administration and provide technical governance for CRM and other business systems

MSP management and IT service delivery

• Own company-wide IT service delivery for a globally distributed workforce.
• Define MSP and contractor responsibilities, service expectations, performance measures, and escalation paths.
• Hold providers accountable for service quality, security, responsiveness, and delivery.
• Delegate operational execution effectively while retaining ownership of outcomes.
• Ensure reliable onboarding, offboarding, hardware provisioning, access changes, and external-user provisioning.
• Oversee the global hardware and endpoint lifecycle, including inventory, standards, security, patching, replacement, and vendor execution.
• Ensure Windows and macOS environments are managed consistently and appropriately.
• Maintain effective support coverage across US and UK/European working hours.
• Step in directly when an issue requires your judgment or expertise, and address recurring problems at their source.

Identity and corporate security

• Own identity and access management across the corporate environment, including SSO, MFA, privileged access, and joiner/mover/leaver processes.
• Own corporate IT security across endpoints, identity, SaaS applications, vendors, and corporate information systems.
• Lead the response to corporate IT security incidents and participate in broader company incident response when needed.
• Own third-party technology and vendor security reviews.
• Maintain practical IT and security policies that reflect how the company operates and support its compliance commitments.

Information management and documentation

• Establish and maintain corporate information-management standards with executives and department leaders.
• Define expectations for information ownership, access, retention, sharing, storage, and lifecycle.
• Ensure important systems, processes, integrations, and administrative responsibilities are documented and transferable.
• Maintain documentation that supports continuity, clear accountability, and efficient vendor oversight.

AI governance and enablement

• Own the client’s approved AI toolkit and AI usage policies.
• Evaluate AI tools, agents, connectors, and integrations for security, data-handling risk, and business value.
• Monitor adoption and spend, and recommend useful new capabilities.
• Coordinate employee training and enablement to support responsible, productive AI use.

What you bring

Ownership and judgment

• 5+ years of relevant IT experience, including accountable ownership of corporate IT operations or a substantial part of the function in a lean organization.
• Evidence of independently identifying problems, evaluating options, making recommendations, and driving work to completion.
• Sound judgment when balancing security, usability, cost, and business needs.
• The ability to explain technical and compliance decisions in business terms.
• Comfort operating as a solo senior contributor whose delivery model depends on MSPs, contractors, vendors, and cross-functional collaboration.

SOC 2 understanding and leadership

• Experience owning or substantially leading a SOC 2 program from within an organization, with meaningful responsibility for program decisions and outcomes.
• A clear understanding of the purpose of SOC 2 and how that purpose shapes scope, controls, implementation, and ongoing operations.
• Experience managing or materially leading the relationship with external auditors, including substantive discussions about controls, evidence, findings, and remediation.
• The ability to evaluate whether a control addresses the intended risk and works in the company’s actual operating environment.
• The ability to work through ambiguity, ask thoughtful questions, and make reasoned recommendations without relying on a prescribed checklist.
• Experience coordinating control owners across technical and business functions.

MSP and vendor management

• Experience managing, evaluating, and holding MSPs and IT vendors accountable.
• The ability to define scope, measure performance, establish oversight, and resolve service gaps when others perform the day-to-day work.
• A demonstrated ability to scale delivery through delegation and governance.

Technical foundation

• Strong working knowledge of identity and access management, including SSO, MFA, privileged access, SaaS access controls, and employee lifecycle processes.
• Working knowledge of Microsoft 365 and Entra ID.
• Experience governing SaaS applications, software inventory, licensing, and access.
• Experience overseeing Windows endpoint security, patching, lifecycle management, and remote support.
• Experience with macOS management, including MDM enrollment, security baselines, and lifecycle processes.
• The ability to understand system integrations, data flows, and dependencies.
• Strong written communication and practical documentation skills.

Preferred experience

• Experience as the primary IT owner in a small or midsize company, or as a senior second-in-command with substantial independent ownership in an organization supporting approximately 100–500 employees.
• Experience supporting an international or fully remote workforce.
• Additional experience with ISO 27001 or comparable security and compliance programs.
• Experience with Microsoft Dynamics 365 or a comparable CRM platform.
• Familiarity with scripting, APIs, Microsoft Graph, PowerShell, or workflow automation.

What success looks like

• The client’s SOC 2 program is credible, sustainable, and aligned with business needs.
• Auditors and internal stakeholders have a clear, accountable program owner who can explain and support decisions.
• Controls address meaningful risks, have clear owners, and operate consistently throughout the year.
• Audits are well managed, with timely evidence, prioritized remediation, and efficient use of internal resources.
• MSPs deliver reliable support within clearly defined responsibilities.
• Employee onboarding, offboarding, hardware, and access changes happen smoothly.
• Corporate systems, SaaS spend, information ownership, and documentation are understood and actively managed.
• Leadership receives clear recommendations and early visibility into material risks.
• Employees experience IT as responsive, practical, and useful.
• The corporate IT function scales effectively through providers, automation, and sound governance.

Working model and location

• This is a remote, senior individual contributor position with no direct reports or mandate to build an internal IT team.
• Schedule flexibility is required to collaborate across US and UK/European time zones, including occasional earlier working hours depending on location.
• Occasional international travel to the United Kingdom is expected, approximately 1–2 trips per year, for company gatherings, planning sessions, leadership meetings, and IT-related work.
• This position reports to the SVP of Engineering.