IT Manager

Cayaba Care; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Cayaba Care is seeking an experienced IT Manager to own day-to-day IT operations, onboarding/offboarding, and IAM for a distributed team. This hands-on, one-person IT role serves as the primary point of contact for all IT and security matters, with future potential to lead a team.

You will manage user provisioning, device fleet with Intune, end-user support across Windows and macOS, and enforce security policies while documenting processes for scale.

Qualifications

• Senior IT experience with one-person IT department at startups.
• Experience in IAM, onboarding/offboarding, and MFA rollout.
• Strong endpoint security, patch management, and encryption knowledge.
• Deep familiarity with Windows and macOS support.
• Scripting skills in PowerShell and Bash for automation.
• Experience in remote-first environments and SLAs.

Responsibilities

• Own day-to-day IT operations and user lifecycle management.
• Provision/deprovision accounts and manage device fleet (Intune).
• Lead IAM strategy, access reviews, and least-privilege enforcement.
• Provide Tier 1-3 end-user support and maintain SLAs.
• Enforce security policies, manage Defender, and patching.
• Document processes and act as primary escalation point.

Skills

Independent work

Communication

Problem solving

Security fundamentals

Remote work

Education

IT Security Certification (e.g., CompTIA Security+)

Google Workspace Administrator

Microsoft 365 Certified: Endpoint Administrator Associate

ITIL Foundation

Tools

PowerShell

Bash

Microsoft Intune

Microsoft Defender

Google Workspace

O365 / Microsoft 365

Job description

• We are seeking an IT Manager to own day-to-day IT operations, user lifecycle management (onboarding/offboarding), and identity & access management (IAM) for our growing, distributed team
• This is a hands-on, one-person IT and security function
• For now, you will be the sole technical resource and the primary point of contact for all IT and security matters, owning the processes end-to-end
• As the function grows, there is the opportunity to build and lead a team beneath you
• You will report directly to the CISO and serve as their key operational partner on access and security matters
• This role goes beyond execution; you’ll set the standards, own the processes end-to-end, and serve as the primary technical escalation point
• You’ll be provisioning and deprovisioning accounts, managing devices through Intune, driving IAM strategy, managing endpoint security, and making sure the right people have the right access at the right time
• The ideal candidate is senior enough to operate independently from day one with no ramp-up required
• You’ve operated as the sole or senior IT resource at a startup, are comfortable wearing every hat, owning ambiguous problems independently, documenting your work, and balancing reactive support with proactive process improvement
• Serve as the primary point of contact and escalation lead for Tier 1-3 technical support requests via ticketing systems
• Support end users across both Windows and macOS environments, including hardware, OS, and application issues
• Troubleshoot connectivity, printing, email, and general software/access issues
• Triage and resolve tickets within defined SLAs, owning escalation paths for complex issues
• Own documentation standards: maintain clear records of common issues, fixes, and internal how-to guides
• User Lifecycle Management & IAM
• Own end-to-end onboarding/offboarding: training for new hires on company systems, account provisioning, device setup, and access control for new hires and departing employees
• Own identity and access management (IAM) strategy, including periodic user access reviews, role/permission assignment, and timely deprovisioning
• Apply and enforce least-privilege principles when granting or reviewing access to systems and applications
• Support SSO configuration and troubleshoot SaaS application access issues
• Maintain accurate records of who has access to what
• Administer Microsoft Intune (MDM) and O365 for a remote, multi-OS device fleet
• Set and enforce security policies across endpoints, including encryption, patching, and compliance configurations
• Deploy, monitor, and manage Microsoft Defender across managed devices
• Own patch management across the fleet
• Handle physical logistics for company devices, including shipping/receiving equipment for new hires, offboarding, and repairs
• Own device inventory tracking and lifecycle management of company hardware, including procurement recommendations
• Manage Google Workspace users, groups, and settings
• Maintain and troubleshoot core SaaS tools used across the organization
• Apply strong security fundamentals across endpoints, identity, and access, including encryption, patching, MFA/conditional access, and least-privilege enforcement
• Partner with the CISO on access-related security requests and remediation items
• Serve as the operational owner of endpoint and identity security
• What Success Looks Like
• New hires are fully onboarded and productive on day one, with no access gaps or delays
• Offboarding is complete and access is revoked promptly, with no orphaned accounts left behind
• IAM access reviews run on a schedule you’ve defined and refined, with clean documentation
• Tickets are resolved consistently within SLA, with a track record of clear communication
• Endpoints remain compliant, patched, and properly enrolled in Intune
• Microsoft Defender and patch management are actively monitored and maintained across the fleet
• IT processes and documentation are mature enough that they could scale to a growing team

Strong written and verbal communication skills, with the ability to explain technical issues to non-technical staff and represent IT to leadershipWillingness to ship, receive, and temporarily store company equipment (e.g., laptops) at their home as part of device lifecycle logisticsHands-on experience with Microsoft Defender and endpoint security, patch management, Microsoft Intune, Google Workspace administrationCustomer service orientation with the ability to remain patient, empathetic, and reassuring when supporting the team7+ years of IT support/operations experience, including experience as the senior or sole IT resourceMust be based in the United States, Eastern Time ZoneExperience owning IAM / access management strategy and end-to-end onboarding/offboarding processes, ticketing systems, and managing work within SLAsAbility to work independently, own ambiguous problems, and manage competing priorities in a remote environmentUnderstanding of PHI and HIPAAStrong working knowledge of security fundamentals: endpoint protection, identity/access security, encryption, patch management, and security best practices in a remote-first environmentExperience supporting both Windows and macOS environmentsStartup experience, having operated as the "one-person IT department" handling infrastructure, security, device management, IAM, and end-user support simultaneously without a larger team to lean onScripting experience (PowerShell, Bash) for task automationExperience with AteraSOC 2 familiarityExperience mentoring or providing technical guidance to junior IT staffSecurity certifications or demonstrable security-focused project work (e.g., implementing MFA rollout, endpoint hardening, incident response)Google Workspace AdministratorMicrosoft 365 Certified: Endpoint Administrator AssociateCompTIA Security+ITIL Foundation