Cloud Systems Administrator

OneImaging; United States; Remote; USD 60,000 - 75,000; Full time

Benefits offered by this job

Equity incentive

Competitive benefits

Disability accommodations

Job summary

OneImaging in the United States is seeking a Systems Administrator to own day-to-day SaaS and cloud operations, focusing on security, logging, and automation.

You will manage access across platforms, script repetitive tasks, respond to security incidents, and provide hands‑on IT support to employees. This generalist role requires ownership of vendor setups and log management.

Qualifications

• 3+ years administering SaaS and cloud platforms in a company of 50–500 people, including Google Workspace and an identity/HR platform like Rippling or Okta, and ideally AWS.
• Hands‑on experience configuring SSO/SAML, SCIM provisioning, MFA policies and role‑based access.
• Working knowledge of audit logging and log review: you know what a CloudTrail event, a Workspace audit log or a Zendesk audit entry looks like and what to do with it.
• Scripting ability in at least one of Python, PowerShell or Bash, and comfort calling REST APIs.
• Experience responding to security incidents (phishing, compromised accounts, lost devices) and documenting what happened.
• Strong IT support instincts: you communicate clearly with non-technical colleagues and close tickets fast.
• Familiarity with HIPAA or a comparable compliance framework (SOC 2, ISO 27001) and what it means for access control and logging.

Responsibilities

• Administer SaaS and cloud platforms: tenant settings, SSO/SAML and SCIM, MFA enforcement, API keys, roles and permissions.
• Configure and maintain audit logging on platforms; centralize logs and ensure retention meets compliance needs.
• Run periodic access reviews, remove stale accounts and over-privileged roles, maintain admin rights inventory.
• Own the security posture of each vendor: review security settings, track security notices, evaluate vendor risk.
• Onboard/offboard employees and contractors across systems, driven from Rippling and Google Workspace as identity sources of truth.
• Manage groups, roles and licenses; keep license counts right-sized and flag waste.
• Maintain device enrollment, MDM policies and endpoint security for company laptops.
• Write and maintain scripts (Python, PowerShell, Bash) and use vendor APIs to automate provisioning, access reviews, log collection and reporting.
• Build lightweight integrations between systems to reduce manual admin work over time.
• Act as a first responder on security alerts: triage, contain, gather evidence, and elevate.
• Participate in post-incident reviews and implement fixes; help maintain incident response and business continuity runbooks.
• Provide tier 1–2 IT support: hardware, accounts, access, video conferencing, printers and office network.
• Procure, image and manage laptops and peripherals; keep asset inventory current.
• Write and keep internal documentation for self-service requests.
• Platforms you will administer: AWS (IAM, CloudTrail, GuardDuty, Security Hub), Rippling, Google Workspace, Databricks, MongoDB Atlas, Sentry, Postman, Stytch, Anthropic, OpenAI, etc.

Skills

SaaS and cloud admin

SSO/SAML and SCIM

MFA enforcement

Audit logging

Scripting (Python/PowerShell/Bash)

REST APIs

Security incident response

IT support

HIPAA/SOC 2/ISO 27001 familiarity

Communication with non-technical users

Tools

Google Workspace

Rippling

AWS

Datadog

Splunk

Job description

Radiology is the second most used healthcare service, used by over 51% of the workforce annually. Despite the critical role of radiology in healthcare, the process for undergoing a medical imaging exam has remained unchanged for decades. OneImaging is solving this with a concierge approach and a premium-quality radiology network of over 5,000 vetted providers across 48 states, which also reduces imaging costs by 60-80%. Our solution helps patients and families access essential radiology services at fair prices and without surprise bills, all while delivering immediate savings and ROI for employers and payers on every exam.

The Systems Administrator owns the day-to-day administration of our SaaS and cloud vendor stack, with security and logging as the first priority. You will manage useraccess across every platform we use, keep audit logging and security controls configuredand reviewed, write scripts to automate repetitive admin work, and act as a firstresponder on security incidents. You will also provide hands‑on IT support to employees.This is a generalist role for someone who likes owning systems end to end: you are theperson who knows how each vendor is set up, who has access to what, and where the logslive.

What you'll do:

Vendor and SaaS administration (security and logging first)

• Serve as the primary administrator for our SaaS and cloud platforms: tenant settings, SSO/SAML and SCIM integration, MFA enforcement, API keys, roles and permissions.
• Configure and maintain audit logging on every platform that supports it; centralize logs where possible and make sure retention meets our compliance needs.
• Run periodic access reviews, remove stale accounts and over-privileged roles, and keep an accurate inventory of who has admin rights where.
• Own the security posture of each vendor: review security settings on new tools before rollout, track vendor security notices, and evaluate new vendor requests for risk.

User lifecycle and identity

• Onboard and offboard employees and contractors across all systems the same day, driven from Rippling and Google Workspace, our identity sources of truth.
• Manage groups, roles and licenses; keep license counts right-sized and flag waste.
• Maintain device enrollment, MDM policies and endpoint security for company laptops.

Scripting and automation

• Write and maintain scripts (Python, PowerShell, Bash) and use vendor APIs to automate provisioning, access reviews, log collection and reporting.
• Build lightweight integrations between systems (for example, HRIS to identity provider to SaaS) so manual admin work shrinks over time.

Security incident response

• Act as a first responder on security alerts: triage, contain (disable accounts, revoke tokens, isolate devices), gather evidence from logs, and elevate.
• Participate in post-incident reviews and implement the fixes that come out of them.
• Help maintain and test our incident response and business continuity runbooks.

IT support

• Provide tier 1–2 support to employees: hardware, accounts, access, video conferencing, printers and office network.
• Procure, image and manage laptops and peripherals; keep an asset inventory current.
• Write and keep up internal how-to documentation so common requests become self-service.

Platforms you will administer

These are our largest software and cloud vendors by spend over the last 12 months. Deep experience with the first group is expected; the rest you will pick up on the job.

• Area
• Platforms
• Cloud infrastructure
• Amazon Web Services (IAM, CloudTrail, GuardDuty, Security Hub)
• Identity, HR and devices
• Rippling (HRIS, SSO, device management) and Google Workspace, used together as our identity source of truth
• Productivity and email
• Google Workspace (admin console, Vault, security center)
• Customer support and CRM
• Communications
• Data and engineering
• Databricks, MongoDB Atlas, Sentry, Linear, Postman, Stytch
• AI platforms
• Anthropic, OpenAI (API key and usage management)
• Collaboration and design
• Security tools
• Healthcare operations
• Waystar, AdvancedMD
• Marketing and recruiting
• Braze, ActiveCampaign, Greenhouse, LinkedIn

About you:

• 3+ years administering SaaS and cloud platforms in a company of 50–500 people, including Google Workspace and an identity/HR platform like Rippling or Okta, and ideally AWS.
• Hands‑on experience configuring SSO/SAML, SCIM provisioning, MFA policies and role‑based access.
• Working knowledge of audit logging and log review: you know what a CloudTrail event, a Workspace audit log or a Zendesk audit entry looks like and what to do with it.
• Scripting ability in at least one of Python, PowerShell or Bash, and comfort calling REST APIs.
• Experience responding to security incidents (phishing, compromised accounts, lost devices) and documenting what happened.
• Strong IT support instincts: you communicate clearly with non-technical colleagues and close tickets fast.
• Familiarity with HIPAA or a comparable compliance framework (SOC 2, ISO 27001) and what it means for access control and logging.

Nice to have:

• AWS Certified SysOps Administrator, Security Specialty, or Google Workspace Administrator certification.
• Experience with a SIEM or log aggregation tool (Datadog, Splunk, Google SecOps, or similar) and writing detection rules.
• MDM experience (Rippling, Jamf, Kandji, Intune) and macOS/Windows endpoint hardening.
• Terraform or other infrastructure-as-code for managing AWS and SaaS configuration.
• Prior work in a healthcare or other regulated company.
• Experience administering API usage and keys for AI platforms (Anthropic, OpenAI) and setting spend and access controls.

The base salary range for this position is $60,000 - $75,000. Individual compensation will depend on various factors, including qualifications, skills, experience, location, and applicable laws. In addition to base salary, this role is eligible to participate in our equity incentive and competitive benefits plans.

OneImaging is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views, or other applicable legally protected characteristics.

OneImaging is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at [e-mail] .