IT Operations & Security Lead

Lever, Inc.; Chicago (IL); Hybrid; CAD 110,000 - 120,000; Full time

Job summary

Zen Educate is seeking an IT Operations & Security Lead to own internal IT systems and security as we scale. You will report to the CTO and join the new Business Systems team as the first dedicated hire to consolidate IT and security across functions.

You will drive modern IT governance, automation, and AI-enabled security posture, ensuring quick provisioning, least privilege, and auditable processes. This role is remote from Canada with collaboration across the UK, US, and Europe.

Responsibilities

• Own Zen Educate's internal IT systems and security as we grow.
• Define, implement and govern modern IT and security practices, including automation and AI adoption.
• Ensure rapid, governed access provisioning and auditable controls across tools and services.

Job description

$110,000 - $120,000 a year

IT Operations & Security Lead

Location: Remote (must be eligible to work in Canada). Collaborating with teams on the West Coast and in Europe, alongside building out a new hub in Chicago.

Type: Full-time

Salary: Our current range across all levels is up to $120k. We are open to negotiation as we recognise there are different situations, but this is our general guardrail.

Our Vision

Every child deserves a better start toward the best possible future. The right educator in the right classroom at the right time can change a child’s chances and, at scale, a nation’s trajectory. Yet too much of our education system’s time, money, and talent are lost to inefficiency.

At Zen Educate, we’re changing that through technology: helping schools save millions in tight times, helping educators find work that rewards their skills and fits their lives, and building a better-educated society that invests its best in every child.

What I’m looking for

Hi, I’m Martin Chief Technology Officer at Zen Educate, and I’m looking for someone to own Zen’s internal IT systems and security as we grow. You’ll report directly to me as part of our new Business Systems team, and you’ll be the first dedicated hire to replace what has so far been spread across several roles.

I’ll lean on you to execute well and to show the way on modern IT and security practice, including automation, governance and AI adoption. Your north star is a clear, proportionate, defensible and scalable IT and security posture, for the company Zen is today and the one it’s growing into.

That means fixing the problem in front of you, while making sure nobody has to fix it manually again tomorrow.

So this probably isn’t the role for you if you solely enjoy clearing ticket queues or becoming very good at provisioning accounts by hand.

It might be if your instinct is: why are we still doing this manually, and who do I need to work with to fix it?

My ideal hire:

• has seen what great looks like and now wants to build their version of it from scratch;
• takes this headspace off my plate, while keeping me informed and involved on the decisions that matter;
• communicates confidently at every level of the business to get things done;
• treats every pound spent here as a pound not spent elsewhere on our mission: investing confidently where it matters, cutting what doesn’t, and making the return easy to see.

Where we are and where we need to go

Zen now has around 600 people across the UK and US (not counting the educators we place in schools), and our IT and security practices need to grow with us.

Up to now, we’ve kept pace with that growth through good people, manual processes and a few well‑kept spreadsheets. It’s worked well. But our growth has steepened recently (yay!), and the cracks and inefficiencies are starting to show.

More people have joined and more software has been bought. We found two company accounts for the same tool, one with a single admin who didn't know they were an admin. Permissions have multiplied and devices are spread across locations. When someone leaves, we work through a long list of accounts to deactivate, with the nagging feeling we’ve missed one.

None of these are particularly unusual on their own, and so far we’ve handled them case by case. But because the responsibility is spread across roles, nobody has the time to build the systems that would make these problems irrelevant, or even turn them into opportunities.

That’s what we want you to solve as we scale. We want an internal environment where:

• our confidence in our posture is high, and justified;
• people get the tools and access they need, quickly, with clear governance over what “need” means;
• we’re secure by default, not because someone remembered;
• “why do we have this?” and “is it still good value?” are easy to answer for any tool;
• audits get more boring each year because the evidence already exists.

We want people at Zen to finish an IT or security request thinking “wow, that was easy”, and occasionally “I didn’t know we needed that, but I’m glad we have it”.

What the role looks like in practice

This is a new role at Zen, so part of the job is defining what it looks like. These are the problems we already know you’ll be working on.

Identity and access

We still grant access to several systems by hand when someone joins. You could improve the checklist. We’d rather you built the workflow that makes the checklist disappear.

You’ll own internal identity and access: Google Workspace, SSO, MFA, groups, permissions and least privilege as a principle. Access should follow people as they join, move and leave, not depend on someone remembering to remove it.

SaaS sprawl

We use a lot of software. Some of it is essential. Some probably isn’t. Some have 80 licences and 37 active users.

You’ll build the definitive view of our software and service estate (what we use, who owns it, who has access, what it costs, when it renews) and work with teams and vendors to improve how we buy, renew and retire tools.

Security that works

Policies are useful. Policies people understand and follow are far more useful.

You’ll define and maintain our IT and security policies, then turn them into working processes, technical controls and training that sticks: access reviews, vulnerability management, external testing, incident processes and an easy way to report concerns.

Trust, assurance and compliance

Customers increasingly want evidence that we take security seriously. You’ll make that evidence easy to provide: security questionnaires, audit evidence, Cyber Essentials and future certifications, risk management and governance. Certifications should follow real controls, not stand in for them.

Rather than answering every questionnaire from scratch, you’ll build a reusable, increasingly self‑service trust process. Where security meets privacy, you’ll work closely with our Legal and Data Protection advisors.

The device fleet

Devices need to be secure, patched, encrypted and accounted for wherever people work, and not all of them are company‑owned. You’ll set a proportionate approach to personal devices alongside endpoint management for our own fleet. Our People Team handles ordering and delivery; you’ll make sure every device is set up and provisioned securely, remotely, through to retirement.

When a critical vulnerability lands, we want to know which devices are affected, what needs to happen, and that it actually happened within our 14‑day patching window.

When something goes wrong

Things will go wrong. A vendor has an incident. A device falls out of compliance. Someone finds access that shouldn’t exist.

Your job isn’t to guarantee nothing happens. It’s to make sure we respond well: clear ownership, good communication, recorded decisions, and the underlying issue actually fixed. We already have an established incident process for our product; you’ll extend it to everything else.

What this role doesn’t own

It covers corporate IT and security, not the platform we build as our product.

• Product and platform security sits with our Foundations Lead and Engineering. You’ll coordinate with them on company‑wide initiatives such as least privilege, and may drive them as overall lead.
• The wider employee lifecycle sits with our People Team. You’ll own the systems, access and devices that support it, and help automate it where you can.
• Internal data architecture and bespoke data tooling sit with your peer in Business Systems. Different lens, often the same problems: you’ll work together a lot.
• Final budget decisions on tools and services sit with me and other senior leaders. You’ll provide the visibility and recommendations to make them well.

What you might like or dislike

Every place makes trade‑offs based on what it values and where it is in its journey. Here are some that might help you decide whether this is the right role for you. If we end up chatting, feel free to dig into any of them. Some are recent changes in our approach and may still be work in progress when you join.

How we work

Build systems, not queues. We see IT as a systems problem, not an administration problem. If something happens repeatedly, challenge whether it still needs a person, whether the answer is scripting, APIs, workflow tools, AI, native platform automation or simply a better process. This is hands‑on: you might discuss security posture with leadership in the morning and fix an access workflow in the afternoon. Either way, today’s fix should shrink tomorrow’s workload.

Proven tools for the obvious, experimentation for the rest. Where a mature tool does the job well, use it rather than building our own. Where nothing does, we’d rather you tried something new, AI included, than accept friction simply because it’s always been done.

Security that enables the business. We want stronger security without theatre or needless friction. That takes judgement: telling a meaningful risk from a theoretical one, and both from one we can reasonably accept. Sometimes the answer is to lock something down, sometimes a better process, sometimes to accept the risk and move on. Whatever it is, you’ll explain clearly what’s happening, why it matters and what happens next.

Be visible and own the outcome. IT and security usually only get noticed when access breaks or someone is told no. We’d like you to change that: a recognisable, approachable go‑to person who brings energy to the space, builds confidence in where we stand and follows problems through to the end.

Growth & progression

Choose your own career path. We care more about impact and learning than rigid competency grids. That gives more flexibility in what progression looks like, but means building an understanding of what we value from guiding principles and shared real‑world examples.

Your manager is a partner, not a supervisor. I’ll not direct your every move. Expect me to help you think through hard problems, offer perspective and nudge you to grow, not to tell you what to do or check your work. You’ll need to own your progress and speak up when you need unblocking.

Few titles, infinite levels. Across Technology we use Levels, not titles, to show growth in a role. Lead is the role; you grow within it by getting better at it, for example working faster, safer and independently. Changing roles is possible too, but depends on business needs.

Investment over reward. Level changes are tightly coupled to compensation changes, and are based on sustainably doing great work at your current level. We think it’s fairer to invest in what you do next than to reward you for doing the next level first for free.

Compensation

Market reality. Compensation is based on your competitiveness in your local hiring market (which isn’t just where you live). Nobody has found a great solution to global compensation, so we aim to be clear and equitable in how we do it.

Solid, not flashy. We pay decently, but we won’t beat companies with deeper pockets (yet!).

Think long term. If you need to prioritise immediate financial gain, this probably isn’t the right time to join us.

Benefits

• Equity compensation
• 20 Paid Vacation Days and 11 Paid Company Holidays
• Comprehensive medical, dental, and vision insurance
• Sick leave
• Paid biweekly

Team culture & collaboration

Remote, but close to the business. This role is remote and serves teams across the UK and US, most of whom aren’t in Technology. Strong communication and async habits are key, and you’ll need to understand how frontline teams actually work, not just how their systems are configured.

Impact and measurable outcomes, alongside shared learning. If your work moves the needle or teaches us something meaningful, that’s a win. If not, we’ll want to understand why.

Balanced, sustainable work. Long hours aren’t a badge of honour; they’re a sign something isn’t working. We value a sustainable pace and healthy teams.

Diversity is good in some ways and lacking in others. You might be the first of something here. That matters, and we’ll support you appropriately if you are.

You’ve probably done this before

Maybe you were the second or third person in an IT, Corporate IT or Security Operations team while a company grew from a few hundred people to something much larger. You’ve seen what breaks, helped fix it, and