Administrator, Systems

Berkeley Research Group, LLC; Washington (District of Columbia); In loco; USD 120.000 - 160.000; Tempo pieno

Descrizione del lavoro

Berkeley Research Group (BRG) via its Second Sight Solutions unit is seeking a Systems Administrator (IAM Engineer) in Washington, DC. You will own identity lifecycle, access governance, and authentication across Entra ID and Microsoft 365, ensuring secure, compliant access for employees and contractors.

Responsibilities include designing CA policies, managing MFA and passwordless methods, and integrating Entra ID with HR, Jira, Jamf, and Intune to streamline provisioning and governance.

Competenze

• 3-4 years IT experience in similar role.
• Hands-on IAM in Entra ID and M365 environment.
• Experience with Zero Trust and access governance.

Mansioni

• Own identity lifecycle for joiner/m mover/leaver in Entra ID.
• Implement CA policies and MFA/passwordless auth.
• Manage privileged access and conduct access reviews.
• Support audits with identity and access evidence.

Conoscenze

IAM expertise

Microsoft Entra ID

M365 administration

PowerShell

SAML/OIDC

Jira integration

Jamf/Intune

Zero Trust

Access reviews

Strumenti

PowerShell

Microsoft Graph

Jamf

Intune

FileVault

Descrizione del lavoro

BRG is an Equal Employment Opportunity/Affirmative Action Employer. All qualified candidates will receive consideration for employment without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, disability, or protected veteran status.

Position Title: Administrator, Systems

Location: Washington, DC

Position Type: Full time

Requisition ID: JR101246

Description:

We Do Consulting Differently

Second Sight Solutions, a subsidiary of Berkeley Research Group (BRG), is a health technology company, and our innovative technology reimagines how drug discount data is exchanged, establishing new connections and improving transparency for drug manufacturers and their customers. Our customers and partners trust us to deliver reliable, first-to-market solutions and safeguard the data we receive. We trust our employees, and our culture gives them the freedom to create, collaborate, and grow. Our leaders are industry experts, creative, unafraid to challenge the status quo, and the pioneers of market-changing solutions.

The Systems Administrator (IAM Engineer) position is a critical role within the Second Sight IT organization and an invaluable resource for Second Sight professionals. This position owns the lifecycle, security, and governance of user identities and access across Second Sight’s Microsoft Entra ID-centered environment, ensuring that the right people have the right access to the right systems at the right time. The right candidate is a highly motivated problem solver who pairs deep identity and access management (IAM) expertise with above average white glove customer service, and who will work closely with the Security Team and the IT Services team to support our customer base (aka Second Sight) in a Mac and Cloud Service supported environment.

Key Responsibilities:

Identity Lifecycle Management

• Own the end-to-end joiner, mover, and leaver process for employees and contractors in Microsoft Entra ID, including account provisioning, role and group changes, and timely revocation of access at offboarding.
• Administer Microsoft Entra ID users, security, and Microsoft 365 groups (including dynamic groups), guest (B2B) accounts, and device registrations, as well as maintain standards for naming, attributes, and group-based licensing.
• Manage user access across the software systems used within Second Sight, including onboarding applications to single sign-on (SAML/OIDC), configuring enterprise applications and app registrations, and automated user provisioning (SCIM) where supported.
• Coordinate with Governance, Risk and Compliance (GRC), HR, department managers, and application owners to define role-based access models and approve, fulfill, and document access requests.

Authentication and Access Control

• Design, implement, and maintain Conditional Access policies, including device compliance, location, and risk-based controls, using documented testing and change management.
• Manage multi-factor and passwordless authentication (e.g., Microsoft Authenticator, FIDO2 security keys, passkeys, Temporary Access Pass), self-service password reset, and authentication method policies.
• Administer privileged access using least-privilege, role-based access control, including Privileged Identity Management (PIM) just-in-time elevation, separate administrative accounts, and emergency (break-glass) account procedures.
• Monitor sign-in and audit logs and identity risk signals (e.g., risky sign-ins and users) and, with the Security Operations Team, investigate and remediate suspicious activity and identity-related security findings.

Access Governance, Audit, and Compliance

• Plan and perform periodic access reviews and recertifications for users, groups, applications, and privileged roles; follow up on remediation and retain evidence for auditors.
• Perform regular audits to ensure compliance with IT and access policies, identify excessive or orphaned access and stale accounts, and identify potential security risks.
• Support internal and external audits and client security assessments by providing identity and access evidence, documentation, and reporting.
• Develop and maintain IAM standards, procedures, runbooks, and metrics; develop and deliver employee training on secure authentication and access practices.

Automation and Integration

• Automate identity lifecycle, reporting, and routine administration tasks using PowerShell, Microsoft Graph, Entra lifecycle workflows, and similar tools.
• Integrate Entra ID with HR sources, Help Desk, and ticketing software (e.g., Jira), endpoint management (Jamf, Intune), and SaaS applications to streamline access requests and approvals.
• Research and evaluate new identity, authentication, and access governance capabilities and recommend improvements.

Endpoint and Systems Support

• Manage endpoints (MacBooks) that are returned to the DC office as part of the off-boarding process. This will include inventorying and preparing for shipment to other endpoint specialists.
• Assist with the onboarding and offboarding process for MacOS users, including setting up new devices and revoking access when necessary.
• Provide Tier 2/3 support for identity and access incidents, such as account lockouts, MFA enrollment and recovery, and application access issues.
• Support Mac devices in coordination with identity controls, including device compliance, FileVault, and Jamf/Intune integration with Entra ID Conditional Access and single sign-on for macOS users.
• The following items are as time is available:
  • Deploy, maintain, and troubleshoot MacBooks and mobile devices (iOS, tablets, and smartphones), both remotely and onsite; manage standardized workstation software configurations and updates and patches for MacOS and installed software with minimal disruption to end users.
  • Troubleshoot general MacOS issues and interactions with Microsoft 365, centralized management software (e.g., Jamf, FileVault), and endpoint security software (e.g., Defender); help Second Sight team members with questions regarding commercial off the shelf (COTS) software applications (Office 365 tools, Adobe, Intune, etc.).

Collaboration and Projects

• Work as part of a team, sharing duties with other IT personnel throughout Second Sight Solutions, and coordinate project actions with the IT Services Manager, System Administrators, vendors and technical representatives, and internal and external clients.
• Coordinate IT project teams, and schedule and organize upgrades, migrations, and maintenance.
• Additional tasks may be required as directed by the IT Services Manager.

Qualifications:

• Minimum 3-4 years of IT experience working in a similar capacity, including at least 2-3 years of hands-on identity and access management experience in a Microsoft Entra ID and Microsoft 365 environment.
• Strong hands-on experience administering Microsoft Entra ID, including Conditional Access, MFA and passwordless authentication, enterprise applications and app registrations, single sign-on, group-based licensing, Privileged Identity Management, and access reviews.
• Solid understanding of IAM concepts and principles, including least privilege, role-based access control, segregation of duties, joiner/mover/leaver lifecycle management, Zero Trust, and authentication and federation standards (SAML, OAuth 2.0, OpenID Connect, SCIM).
• Proficiency