IT Operations Lead

OpenKrill; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

Blackpoint Cyber is seeking an IT Operations Lead to serve as the operational leader for IT execution and our in-house Microsoft Entra ID expert. This hands-on, leader‑coach role will own architecture, security posture, and automation end-to-end while mentoring an IT team across a distributed workforce.

You will drive identity and access: from Entra ID architecture to privileged access management, SSO, device identity, and SaaS integrations, partnering with security and engineering to deliver

Qualifications

• 7–10+ years in systems engineering or senior IT infrastructure.
• At least 4 years deep, hands-on Microsoft Entra ID experience.
• Expertise in Conditional Access, PIM, SAML/OIDC federation.

Responsibilities

• Lead IT operations for enterprise IT platforms and Entra ID.
• Own Entra ID architecture, including CA, MFA, and device identity.
• Mentor IT staff and coordinate with CSTO on prioritization and planning.
• Manage security controls, access governance, and vendor access programs.

Skills

Microsoft Entra ID expertise

Conditional Access

PIM

Identity governance

Automation (Graph API/PowerShell)

Tools

Microsoft Graph API

PowerShell

Python

Bash

Job description

Blackpoint Cyber is the leading provider of world‑class cybersecurity threat hunting, detection and remediation technology. Founded by former National Security Agency (NSA) cyber operations experts who applied their learningsto bring national security-grade technology solutions to commercial customers around the world, Blackpoint Cyber is in hyper‑growth mode, fueled by a recent $190m series C round.

WHAT YOU'LL DO

As IT Operations Lead, you are the operational leader for IT execution at Blackpoint Cyber and our in‑house Microsoft expert. Your job is to turn CSTO‑set strategy into delivered work. You are also the engineering authority for identity and access: Microsoft Entra ID is the control plane for our workforce, and you will own its architecture, security posture, and automation end to end. You will set the technical standards for our endpoint platforms (Intune and Jamf) and SaaS integrations.

This is a deeply hands‑on player‑coach role, and we expect the majority of your time to be spent in the technology itself. It is designed for an established senior engineer who is ready to take the next step into leadership: you will do the hardest technical work yourself while building your management skills by directing the IT Administrator and other IT staff day to day, planning and prioritizing work, and mentoring. You will support approximately 230 team members across a distributed workforce.

KEY RESPONSIBILITIES

Translate strategy and priorities into projects and tasks. Sequence and assign work, run weekly planning, track status, remove blockers, and report progress and risks to the CSTO.

Set daily priorities for the IT Administrator and other IT staff, review changes, coach, and author the architecture documentation, runbooks, and change standards the team follows.

Serve as the final technical escalation point for identity, endpoint, and SaaS incidents, run root cause analysis, and drive permanent fixes. Implement the platform and tooling decisions already set by leadership, with feasibility and effort estimates and the vendor and licensing tasks needed for delivery.

Own Entra ID architecture and privileged access. Design and operate Conditional Access, authentication methods, passwordless and phishing‑resistant MFA, Privileged Identity Management (PIM), admin role hygiene, break‑glass accounts, and delegated administration.

Govern the identity lifecycle. Use the Entra ID P2 feature set (access reviews, entitlement management, Identity Protection) and own the automated joiner, mover, and leaver flows, including the onboarding and offboarding flows.

Own SSO and application integration. Manage app registrations, enterprise applications, SAML and OIDC federation, and SCIM provisioning across Entra and Auth0, both of which remain in use. This includes Atlassian SSO and SCIM and group‑based role structures such as the Claude Enterprise access layers built on Entra SCIM groups.

Own device identity. Manage Entra join and registration, including Platform SSO and Entra sign‑in on macOS, and the tie between device identity, Intune compliance, and Conditional Access.

Govern external and third‑party access. Own guest (B2B), contractor, agency, and vendor access patterns in Entra and Microsoft 365, including time‑bound access, sponsorship, and SFTP or website access for outside partners.

Create the standard‑access catalog. Maintain the access role matrix and role‑based, pre‑approved access bundles, plus an approval matrix, so routine requests are fulfilled by the IT Administrator without lead involvement.

SECURITY AND COMPLIANCE CONTROLS

Own technical controls for CMMC Level 2. Implement and evidence the technical controls assigned to IT, such as MFA and lockout policy, MDM policies and endpoint configuration baselines, removable media controls, least‑privilege and admin access, backup configurations, audit‑log alerting, remote access, patch management, and system inventory and network diagrams.

Support SOC 2 Type 2 and policy governance. Remediate access‑related control findings (access revocation, access to production), run periodic user access and firewall configuration reviews, review security policies (such as Access Control, Passwords, and Device Security) for technical accuracy, and review vendor intake requests from the IT perspective.

Remediate security findings on corporate systems. Close findings on corporate web properties and infrastructure, such as exposed staging sites, outdated components, abandoned hosting, and dangling DNS records, together with Marketing, Web, and Security.

Partner with Security on identity threat detection. Monitor sign‑in and audit logs, tune risk policies, respond to identity‑based incidents, and write KQL for dashboards and detections. Answer identity and device audit‑log requests and own compliance reporting.

Set endpoint and SaaS standards. Own the architecture, configuration baselines, compliance policies, and security policy for Intune, Jamf, and Datto RMM, and the integration standards for Microsoft 365, Google Workspace, Slack, and Zoom. Day‑to‑day operation sits with the IT Administrator.

Administer Atlassian and workflow automation. Own administration of Jira, Jira Service Management, and Confluence, including the IT service workflow, and the Power Automate flows that support IT processes, with flow ownership, failure alerting, and runbooks.

Own AI tool administration and governance. Set usage policy, seat and quota approval criteria, and security review for AI tools such as Claude, Claude Code, and Cursor, including team and admin ownership, connectors, and MCP servers.

Deliver business‑system integrations. Lead the IT side of integrations and enterprise app provisioning, such as Salesforce, the HR system, the compliance platform and Intune integration, telephony and sales tooling reviews, and apps that support Engineering and SOC repositories.

Broker cloud and engineering infrastructure access. Define how access to AWS, Azure, VPN, and engineering tools such as Cloudflare, log search, and deployment tooling is requested, approved, and granted, working with SRE and Security.

Oversee corporate network and office infrastructure vendors. Manage relationships and renewals for firewall, physical access control, network connectivity, and similar vendors, and keep the system inventory and renewal calendar current.

Be the Microsoft subject‑matter expert. Serve as the deepest Microsoft resource in the company across Entra ID, Microsoft 365, Intune, Defender, and Azure fundamentals, and the authority on any Microsoft platform question.

Support Product and Engineering environments. Own the IT side of the Mac and Windows labs, the integration lab, VDI environments, test tenants, dogfooding setups, and engineering onboarding, including reproducing customer‑style Microsoft 365 and Entra scenarios.

Support deployment of the Blackpoint agent through Datto RMM. Maintain the installer guides, scripts, and ComStore component used to deploy the Unified Agent, and provide technical escalation support on Datto RMM deployment issues raised through Technical Support.

Automate everything repeatable. Build and maintain automation using Microsoft Graph, PowerShell, Power Automate, and Python for provisioning, offboarding, license assignment, group governance, and reporting. Keep work in source control and make changes auditable.

QUALIFICATIONS

• 7 to 10+ years in systems engineering, identity engineering, or senior IT infrastructure, with at least 4 years of deep, hands‑on Microsoft Entra ID experience in a production tenant.
• Demonstrated expert‑level skill with Conditional Access, PIM, authentication methods, app registrations and enterprise apps, and SAML/OIDC federation.
• Hands‑on experience with Entra ID P2 capabilities: Identity Protection, access reviews, and entitlement management.
• Strong automation skills with Microsoft Graph API and PowerShell; Python or Bash a plus.