IT Systems & Network Engineer

Flamapp; India; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Flam is an AI-native content platform building the future of interactive experiences. We seek an IT admin/security engineer to own device lifecycles, deploy MDM, enforce security, and manage cloud and identity across a fast-moving startup in Bengaluru.

You will secure endpoints, oversee MFA deployments, and coordinate onboarding/offboarding with HR to maintain ISO 27001 and SOC 2 readiness.

Qualifications

• 3–4 years in IT admin, IT ops or junior security role.
• Hands-on with at least one MDM platform (Jamf, Kandji, Intune).
• Experience administering Google Workspace or Microsoft 365 at org level.
• Familiar with GCP or AWS IAM, VPC, storage, and audit logs.
• Experience with identity providers and SSO (Okta, Google Workspace, Azure AD).
• Understanding endpoint security: encryption, EDR, patch management.
• Comfortable in a fast-moving startup with end-to-end ownership.

Responsibilities

• Own the device lifecycle for 100+ employees: procurement, configuration, deployment, and secure disposal.
• Deploy and maintain an MDM solution across all devices.
• Enforce security policies: full-disk encryption, MFA, automatic OS updates, antivirus/EDR, remote wipe.
• Maintain a real-time device inventory with owner, classification, and compliance in Scrut.
• Conduct quarterly MDM compliance audits showing 100% policy enforcement across devices.
• Onboarding/offboarding: ensure MFA, accounts provisioning and revocation within 24 hours.

Skills

MDM platforms

Google Workspace

IAM

SSO

Endpoint security

Cloud security

Networking basics

Tools

Jamf

Kandji

Microsoft Intune

Scrut

GCP

AWS

Job description

Flam is an AI-native content platform building the future of interactive experiences. Our proprietary AI models power four product lines — Flam Instant App (mixed reality advertising), Flam AI Visual Agent (real-time avatar interactions), Flam Native Ads, and Flowy.ai (AI creative canvas) — serving Fortune 500 brands across the US and India. We are a 100+ person organisation running on GCP and Modal.com, actively pursuing ISO 27001:2022 and SOC 2 Type I certification.

The Opportunity :

What You'll Own

• Own the full device lifecycle for all 100+ employees — procurement, configuration, deployment, and secure disposal of MacBooks and any other endpoints
• Deploy, configure, and maintain an MDM solution (Jamf, Kandji, Microsoft Intune, or equivalent) across all employee devices
• Enforce security policies via MDM: full-disk encryption, screen lock, automatic OS updates, antivirus/EDR installation, and remote wipe capability
• Maintain a real-time device inventory in Scrut's Asset Management module — every device tagged with owner, classification, and compliance status
• Conduct and document quarterly MDM compliance audits showing 100% policy enforcement across all devices

Onboarding & Offboarding

• Own the technical onboarding checklist — new joiner gets their device configured, all SaaS accounts provisioned, and MFA enrolled before Day 1
• Own offboarding — access revocation across all systems within 24 hours of departure, device retrieval, and remote wipe if required
• Maintain joiners/leavers/movers log as evidence for ISO 27001 A.5.18 and SOC 2 access control criteria
• Work with HR to ensure zero orphaned accounts — monthly reconciliation of IDP user list against HR active employee records

Identity & Access Management

• Administer the Identity Provider (Google Workspace, Okta, or equivalent) — user provisioning, group management, SSO configuration for all SaaS tools
• Enforce MFA across all accounts — export and maintain 100% MFA enrollment report as ongoing audit evidence in Scrut
• Conduct quarterly access reviews across all systems — coordinate with department heads to confirm access is still required for each user
• Manage service account inventory in GCP — ensure all service accounts have named human owners and minimum necessary permissions

SaaS Tool Administration

• Administer and secure all company SaaS tools — Google Workspace, Slack, Notion, GitHub, Jira, Scrut, and others
• Maintain an approved SaaS tool register — track what tools are in use, who owns them, what data they hold, and their security configuration
• Enforce SSO and MFA on every SaaS tool where the platform supports it
• Identify and remove shadow IT — tools being used by teams without IT awareness or approval

GCP & Cloud Security

• Work alongside DevOps to implement and maintain GCP security configurations: VPC firewall rules, IAM policies, org-level security policies, and Cloud Audit Logs
• Connect GCP and Modal.com to Scrut's Cloud module and maintain automated security posture scanning — track and remediate misconfigurations
• Ensure encryption at rest is enabled on all GCS buckets containing customer data and model weights
• Maintain centralised logging in GCP Cloud Logging — confirm audit logs are enabled across all projects, retained for 12 months, and tamper-protected
• Run regular vulnerability scans using GCP Security Command Center or equivalent — document findings and track remediation to closure

Network & Office Security

• Manage office network security at both the HSR Layout (Bengaluru) office — VLAN segmentation, guest Wi‑Fi isolation, DNS filtering
• Deploy and maintain VPN for remote access to internal systems and production infrastructure
• Configure and maintain web filtering (Cloudflare Gateway or equivalent) covering both office and remote workers
• Maintain network diagrams and data flow diagrams as required by Scrut control AST-04

Security Controls & Audit Evidence

• Own all technical controls in Scrut across the Endpoint Security, Identification & Authentication, Network Security, Cloud Security, and Asset Management domains — 60+ controls directly under your remit
• Collect, upload, and maintain evidence in Scrut for every assigned control — screenshots, exports, scan reports, configuration files
• Respond to evidence requests from the GRC Lead and external auditors during ISO 27001 Stage 1/Stage 2 audits and SOC 2 assessment
• Implement and test the remote wipe procedure for lost or stolen devices — document test results as audit evidence

What We're Looking For

• 3–4 years of experience in an IT admin, IT operations, or junior security engineer role
• Hands‑on experience with at least one MDM platform — Jamf, Kandji, Microsoft Intune, or equivalent
• Experience administering Google Workspace or Microsoft 365 at an organisational level — user management, group policies, security settings
• Familiarity with GCP or AWS — comfortable navigating IAM, VPC, storage, and audit log configurations
• Experience with identity providers and SSO — Okta, Google Workspace, Azure AD
• Understanding of endpoint security fundamentals — disk encryption, EDR, antivirus, patch management
• Comfortable working in a fast‑moving startup where you will own problems end‑to‑end without a large team behind you

Nice to Have

• Experience supporting a SOC 2 or ISO 27001 audit — collecting evidence, responding to auditor requests
• Familiarity with a GRC platform (Scrut.io, Vanta, Drata, or equivalent)
• Google Workspace Administrator certification or GCP Associate Cloud Engineer certification
• Experience with CI/CD security tooling — GitHub Actions security, container image scanning, SAST integration
• Knowledge of network security fundamentals — VLANs, firewall rules, DNS filtering, VPN
• Scripting ability (Python or Bash) for automating IT operations tasks — account provisioning, compliance reporting
• Prior experience at a startup or high‑growth tech company