Google Workspace Administrator

Creative Global Consulting; Washington, Baltimore (District of Columbia, MD); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Creative Global Consulting seeks a US Citizen Google Workspace Administrator for the USHMM on a 12+ months contract. The senior contributor will own the Workspace tenant end-to-end, configure for security/compliance, and train a team of 6–8 admins. Hybrid onsite in Washington, DC with federal standards in scope.

Responsibilities include MFA enforcement, Okta-based SSO, Drive/Gmail admin, and coordination with ServiceNow, CASB/DLP tooling, and Google Vault considerations.

Qualifications

• Google Workspace Administrator Professional certification is mandatory.
• Experience administering Google Workspace at large enterprise or federal scale.
• Strong identity management with MFA and zero-trust fundamentals; Okta experience desired.
• Experience supporting NIST-, FISMA-, and FedRAMP-aligned environments.

Responsibilities

• Administer all Workspace domains and services as primary owner.
• Enforce MFA for all users, and manage SSO via Okta.
• Coordinate with ServiceNow for ticketing and incident workflows.
• Maintain compliance documentation and runbooks per NIST/FISMA/FedRAMP.
• Provide training and guidance to Google administrators.

Skills

Google Workspace Administration

Identity management

MFA

Okta

NIST compliance

FedRAMP

Zero-trust

Education

Google Workspace Administrator Professional certification

Tools

ServiceNow

Jamf

Endpoint Central

CASB/DLP tooling

Job description

Period of Performance:

12+ Months Contract

Clearance:

Public Trust suitability + OPM FBI fingerprint criminal background check with financial/credit review; re-screened annually

Role Summary:

As an US Citizen , you gace to work as a Google Workspace Administrator, who will be the single dedicated full-time resource responsible for administering, governing, and optimizing USHMM's entire Google Workspace tenant. This person is the primary point of contact for all Workspace-related activity — configuring the platform to meet business, security, and compliance requirements, and providing technical training and documentation to the Museum's existing team of roughly 6–8 Google administrators. This is a senior individual-contributor role: the person owns the environment end to end and works across all support tiers depending on the problem, not just Tier 3.

Environment You'll Be Administering

This is a large, mature enterprise tenant — not a small shop. Scope includes:

• ~902 active users (925 provisioned), 22 organizational units, 653 groups
• 1,294 shared drives, 23.5 TB Drive storage, ~47 TB total footprint
• 40 privileged administrators to coordinate with and govern
• 1 primary domain, 2 secondary domains/aliases
• Okta as the identity source of truth (SSO/MFA already in place)
• ServiceNow for ticketing, change, and incident workflow
• Jamf (Apple), Google MDM (mobile), Endpoint Central (everything else)
• Third-party CASB for DLP; Google Vault with indefinite retention
• Commercial Workspace tenant, with an active initiative to move toward FedRAMP Moderate

Core Responsibilities:

Platform Administration & Account Management

• Administer all Workspace domains and services as primary owner
• Manage users, groups, OUs, and role-based access controls
• Own identity lifecycle: onboarding, role changes, offboarding
• Manage licensing, subscriptions, and cost/storage optimization (Drive storage and license right-sizing are named priorities)

Core Service Management

• Administer and optimize Gmail, Drive, Docs/Sheets/Slides/Forms, Meet, Chat, and Calendar
• Stand up and support Gemini for Workspace and NotebookLM for internal Museum use

Security & Access Controls

• Enforce MFA for all users, mandatory for privileged accounts
• Configure and maintain SSO/identity federation via Okta
• Enforce password, session-control, and device-trust policies
• Manage DLP, IRM, and secure-sharing controls in coordination with the CASB
• Monitor security alerts; respond to phishing, account compromise, and unauthorized access

Compliance & Risk Management

• Maintain alignment with NIST CSF, NIST SP 800-53, and FISMA
• Support the migration toward FedRAMP Moderate consistent with Museum direction
• Maintain documentation and evidence supporting audits, assessments, and ATO activities
• Understand that federal PII is treated as CUI, with State Privacy Acts, PCI, and HIPAA also in scope, and NARA/M-19-21 records-management requirements in effect

Operations & Maintenance

• Routine health checks, configuration reviews, and policy/feature updates
• Change management to minimize disruption; incident, outage, and escalation response
• After-hours/weekend response for critical or mission-critical outages (normal coverage is business hours)

Planning & Optimization

• Lead strategic planning for Workspace adoption; maintain a continuous-improvement roadmap
• Evaluate new features for Museum applicability; recommend automation and UX improvements

Stakeholder Coordination & Training

• Serve as liaison among Museum leadership, IT, program offices, and Google support
• Provide technical training and best-practice guidance to the Museum's Google administrators and broader community

Deliverables the Person Owns

Governance/administration documentation, security and access-control policies, NIST/FISMA/FedRAMP-aligned compliance documentation, operational runbooks and incident-response procedures, user lifecycle procedures, and monthly status reports.

Required Qualifications:

• Google Workspace Administrator Professional certification, current and in good standing — this is mandatory, not preferred. No exceptions; a candidate without it is non-compliant.
• Hands-on experience administering Google Workspace at large enterprise or federal/federal-adjacent scale (hundreds to ~1,000 users, complex OU/shared-drive structures)
• Strong identity management, MFA, and zero-trust fundamentals; direct Okta experience strongly desired
• Experience supporting NIST-, FISMA-, and FedRAMP-aligned environments
• Able to obtain Public Trust suitability and pass an OPM fingerprint criminal check with credit/financial review
• U.S. citizenship or work authorization; able to work onsite in Washington, DC on a hybrid schedule (~10 onsite days/month, five every two weeks)

Preferred Qualifications:

• Google Cloud Certified — Professional Cloud Security Engineer
• Google Cloud Certified — Professional Cloud Architect
• ServiceNow, Jamf, Endpoint Central, and CASB/DLP tooling familiarity
• Experience with Google Vault retention and NARA records-management requirements