IT Operations Administrator

Outsourced; Colombia; Vor Ort; COP 60.000.000 - 90.000.000; Vollzeit

Zusammenfassung

Rovally seeks an IT engineer to own end-to-end IT for multiple managed clients. You’ll run identity, device management, endpoint security, SSO provisioning, and onboarding support across three early-stage tech companies.

Key focus areas are IAM and automation, with a quarter on endpoints and security tooling and a quarter on help desk. A strong automation mindset will scale the practice over time.

Qualifikationen

• Experience designing joiner/mover/leaver automation.
• Strong IAM concepts with day-one entitlements.
• Ability to automate repetitive IT tasks with code.
• Okta Workflows experience is a plus.

Aufgaben

• Stand up and maintain Okta for each client with HRIS integrations.
• Design birthright access by role and location for new hires.
• Automate across the stack using workflows and REST APIs.
• Administer CrowdStrike Falcon and Island browsers; manage MDM.
• Lead onboarding and respond to day-to-day IT requests.
• Track work in Linear and report weekly status.

Kenntnisse

Okta IAM

Automation

Python

PowerShell

Bash

REST APIs

IaC (Terraform/Pulumi)

MDM management

Security tooling

SAML/OIDC

Tools

CrowdStrike Falcon

Island Enterprise Browser

Kandji/Jamf/Intune

Google Workspace

Microsoft 365

SSO tooling (Okta/SSO)

Linear

Jobbeschreibung

The role

You will be the IT engineer for our client's managed IT clients. At launch that is three venture-backed technology companies. You own their IT end to end: identity, device management, endpoint security, the secure browser, the SaaS stack, and the help desk that sits on top of it. There is no one behind you doing the hands-on work, and no separate help desk under you yet. That is the point: we are hiring someone who can run the whole thing well.

The biggest share of the work is identity and access management. We wire up Okta for each client, integrate their applications, and build the joiner, mover, and leaver automation so that every new hire has the right entitlements from day zero and every departure is fully cut off. Around that, you administer Island Enterprise Browser, deploy and manage CrowdStrike Falcon, keep devices enrolled and compliant in MDM, and answer the day-to-day requests from each client's staff.

A rough split: half your time on identity and automation, a quarter on endpoints and security tooling, and a quarter on help desk and onboarding. What ties it together is automation. We want someone who sees a repeated task and builds the workflow, script, or policy that makes it go away.

This role is how we grow the practice. If it goes well, we take on more IT clients and add a dedicated help desk hire who works under your direction.

What you will own

IDENTITY AND ACCESS (OKTA)

• Stand up and maintain Okta for each client: HRIS as source of truth (Rippling, HiBob, BambooHR, Gusto), profile mappings, groups and group rules, authentication policies, and MFA.
• Integrate client applications with SSO (SAML and OIDC) and, wherever the app supports it, SCIM provisioning. Where it does not, build the next best thing and document it.
• Design birthright access by role, department, and location so a new hire's entitlements are correct on day zero without anyone asking.
• Keep a per-client identity map: every app, how it is provisioned and deprovisioned, who owns it, and which ones still need manual steps.

WORKFLOWS AND AUTOMATION

• Build and maintain joiner, mover, and leaver automation with Okta Workflows and the APIs of the tools our clients already own.
• Automate across the stack, not just identity: device assignment and enrollment, Island and CrowdStrike policy assignment by group, license reclamation, and access review exports.
• Script where Workflows run out: Python, PowerShell, or Bash against REST APIs. Infrastructure as code (the Okta Terraform or Pulumi provider) is a plus.
• Push manual steps toward zero. Every one you remove is one less way for access to linger or a step to be missed.

OFFBOARDING THAT HOLDS UP

• Own offboarding end to end: deactivate in the identity provider, confirm every downstream app received the deprovision, revoke active sessions (including mobile), lock and recover the device, and close out the apps that sit outside SSO.
• When a deprovision does not land, find out why from the logs and fix the integration so it does not happen again. Treat every miss as a root cause to remove.

ENDPOINTS AND SECURITY TOOLING

• Administer Island Enterprise Browser: tenant configuration, identity integration, browser policies (data loss controls, extension management, access rules), rollout to users, and troubleshooting.
• Deploy and manage CrowdStrike Falcon: sensor rollout through MDM, prevention and update policies, host groups, staged pilot then fleet rollouts, and ML exclusions for developer tooling without opening visibility gaps.
• Manage macOS fleets in MDM (Kandji, Jamf, or Intune): enrollment, baselines, OS and app updates, preinstalled apps, managed browser extensions, and device compliance.
• Work alongside our security team when an alert or incident has an IT component: isolate a host, pull a device, reset access.

HELP DESK AND ONBOARDING

• Answer client IT requests in Slack and in the ticket queue during business hours: access, MFA resets, SSO errors, device issues, and "I cannot get into X." Acknowledge quickly and drive each one to closed.
• Run first-day onboarding calls with new hires: Okta sign-in, MFA, Island, core apps, and where to go for help. Confirm everything works before you hang up.
• Administer the common SaaS layer: Google Workspace, Microsoft 365, Slack, Zoom, 1Password, and the long tail of tools each client runs.

COMPLIANCE SUPPORT

• Produce the IT evidence our GRC team needs: user access reviews, onboarding and offboarding records, MFA and SSO coverage, device compliance, and EDR coverage.
• Work with Rovally's GRC analysts when an audit control touches IT, so the configuration and the evidence match.

TRACKING AND STATUS

• Track every piece of work in Linear, and in the client's ticketing system where they use one. If it is not in Linear, it did not happen.
• Give Rovally leadership a clean status picture each week: what shipped, what is open, what is blocked, and what is still manual per client.