IT Systems Engineer

Tempo; United States; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Tempo is building a scalable, payment-first IT backbone for a crypto-forward world. You will own Tempo's corporate IT infrastructure—identity, device management, and endpoint security—bringing software-engineering rigor to secure systems at crypto scale.

This hands-on role goes beyond help-desk tasks: you will automate provisioning, secure access, and enable IaC workflows to support rapid growth across teams and partners.

Qualifications

• 4+ years in IT engineering roles.
• Hands-on Okta administration: SSO, SCIM, SAML/OIDC integrations, lifecycle policies.
• Jamf Pro experience, macOS-first, PreStage enrollment and profiles.
• Operated an EDR platform (SentinelOne) with policy tuning and deployment.
• Strong scripting, REST APIs, webhooks, JSON, auth flows, event-driven workflows.
• Git-based config management and CI/CD with GitHub Actions; IaC tooling such as Terraform.
• Fundamental DNS, certificates/PKI, and modern access controls (ZTNA, SSO).

Responsibilities

• Architect and automate identity lifecycle across HRIS, Okta, and SaaS apps.
• Maintain SSO/SCIM integrations across the SaaS stack.
• Own Jamf Pro end-to-end: enrollment, profiles, updates, certificates.
• Deploy and tune endpoint security; manage policies and MDM deployment.
• Expand SIEM coverage and write detection/alert rules.
• Move IT tooling toward infrastructure-as-code (Terraform, CI/CD).
• Resolve escalations in identity, device, and access.
• Drive SOC 2 readiness with unified audit trails.

Skills

4+ years in IT engineering

Scripting (Python/Bash/Go)

REST APIs & webhooks

Git-based config management

CI/CD pipelines

DNS, PKI & access control

Tools

Okta administration

SAML/OIDC integrations

Jamf Pro

SentinelOne EDR

Terraform

GitHub Actions

ZTNA (e.g., Tailscale)

Job description

Tempo is a layer-1 blockchain purpose-built for stablecoins and real-world payments, born from Stripe’s experience in global payments and Paradigm’s expertise in crypto tech.

Tempo’s payment-first design provides a scalable, low-cost predictable backbone that meets the needs of high-volume payment use cases. Our goal is to move money reliably, cheaply, and at scale. Our north star is simplicity for users: fintechs, traditional banks, merchants, platforms, and anyone else looking to move their payments into the 21st century.

We're building Tempo with design partners who are global leaders in AI, e-commerce, and financial services: Anthropic, Coupang, Deutsche Bank, DoorDash, Mercury, Nubank, OpenAI, Revolut, Shopify, Standard Chartered, Visa, and more.

We’re a team of crypto-optimists, building the infrastructure needed to bring real, substantial economic flows onchain. We like to move fast and swing for the fences — join us!

The Role

You’ll own and build Tempo's corporate IT infrastructure — identity, device management, endpoint security, and the automation that ties it all together. This is a hands-on engineering role, not a help desk seat. You’ll bring software-engineering rigor to IT systems and help secure a company operating at the frontier of crypto.

Responsibilities

• Architect and automate the full identity lifecycle — HRIS → Okta → SaaS apps — eliminating manual provisioning and off boarding gaps

• Complete and maintain SSO/SCIM integrations across the entire SaaS stack

• Own Jamf Pro end to end: PreStage enrollment, configuration profiles, software updates, certificate distribution

• Deploy and tune endpoint security (SentinelOne) — policy management, MDM-driven deployment, alert triage

• Expand SIEM coverage and write detection/alerting rules with a detection-as-code approach

• Build toward infrastructure-as-code management of all IT tooling (Terraform, GitHub Actions)

• Resolve hard identity, device, and access escalations that get past first-line support

• Drive SOC 2 readiness — unified audit trails across identity, device, and security systems

Qualifications

• 4+ years in IT engineering roles

• Hands-on Okta administration: SSO, SCIM, SAML/OIDC integrations, lifecycle policies, Okta Workflows. Understands HRIS-as-source-of-truth (Rippling or similar)

• Production Jamf Pro experience: PreStage enrollment, configuration profiles, software update management, certificate distribution. macOS-first

• Deployed and operated an EDR platform (SentinelOne or comparable) — policy tuning, MDM deployment, alert triage

• Strong scripting (Python/Bash/Go preferred), comfortable with REST APIs, webhooks, JSON, auth flows, and event-driven workflows

• Git-based config management, CI/CD pipelines (GitHub Actions), Terraform or equivalent

• Solid grasp of DNS, certificates/PKI, ZTNA (Tailscale or similar), and modern access control models

Nice-to-Haves

• Crypto/blockchain security exposure — multisig/hardware-wallet workflows (Fireblocks or similar), phishing/lookalike-domain campaigns, high-value signer threat models

• Detection-as-code: SIEM detections as version-controlled rules (Panther Python models, Sigma, or equivalent)

• Apple platform depth beyond basic Jamf — DDM, MDM protocol internals, notarization/signing/packaging, macOS security frameworks (TCC, system extensions)

• Mapped controls to SOC 2, ISO 27001, NIST CSF, or CIS — understands what audit-ready evidence looks like

• Built Slack-driven workflows, bots, or self-service internal tooling

• Public open-source contributions to IT/security tooling