Principal, Enclave Systems & Support Administrator

Ingram Micro Inc; Irvine (CA); On-site; USD 133,000 - 227,000; Full time

Benefits offered by this job

Healthcare benefits

401(k) with company match

Paid time off

Job summary

Ingram Micro Inc. is seeking an Enclave Systems & Support Administrator to design, build, harden, and operate a secure enclave.

You will configure identities, endpoints, data-protection controls, and manage tier-1 to tier-3 support, provisioning endpoints and security keys for users during migration and steady-state operations. You will lead architecture, build, and change management tasks, including SSO, FIPS cryptography, and scripting for provisioning.

Qualifications

• 7+ years in enterprise IT admin and security.
• Experience administering Google Workspace Enterprise Plus at scale.
• Strong identity and access management background.

Responsibilities

• Administer Google Workspace Enterprise Plus: security, DLP, drive labels; config admin roles.
• Build/operate ChromeOS / Chrome Enterprise endpoints and AWS GovCloud WVDI.
• Configure SAML SSO with FIDO2 and Context-Aware Access policies.
• Establish hardened baselines; enforce FIPS-mode cryptography.
• Run change management and document configuration changes.
• Develop scripting/automation for provisioning and reporting; maintain backups.

Skills

Google Workspace admin

End-user support

Identity & access management

MFA lifecycle management

Education

Bachelor's degree in cyber security or related field

Tools

AWS GovCloud

Amazon WorkSpaces / VDI

Chrome Enterprise

Google Workspace Enterprise Plus

Job description

Ingram Micro is a leading technology company for the global information technology ecosystem. With the ability to reach nearly 90% of the global population, we play a vital role in the worldwide IT sales channel, bringing products and services from technology manufacturers and cloud providers to business-to-business technology experts. Our market reach, diverse solutions and services portfolio, and digital platform Ingram Micro Xvantage™ set us apart. Learn more at www.ingrammicro.com

Your role:

The Enclave Systems & Support Administrator designs, builds, hardens, and operates the technical enclave - configuring identity, endpoints, data-protection controls, and FIPS-validated cryptography, and running change management - while also delivering tier-1 through tier-3 support: provisioning endpoints, issuing and tracking FIDO2 security keys, resetting credentials under least-privilege scope, and onboarding/training end users through migration and steady-state operations.

Architecture, Build & Change Management

• Administer Google Workspace Enterprise Plus: Cloud Identity, OU design, custom admin roles, DLP, Drive labels/IRM, trust rules, and mail compliance.
• Build and operate ChromeOS / Chrome Enterprise endpoints and Amazon WorkSpaces (AWS GovCloud) Windows VDI.
• Configure SAML SSO with FIDO2 phishing-resistant authentication and Context-Aware Access policies.
• Establish and maintain hardened configuration baselines; enforce FIPS-mode cryptography across data states.
• Run change management: document, test, and approve configuration changes against the baseline and SSP.
• Develop scripting / automation for provisioning, configuration, and reporting; maintain backup and restore.
• Produce configuration evidence for control assessments and the C3PAO / KPMG reviews.

Front-Line Support & Access Hygiene

• Provide tier-1 through tier-3 service desk support, including the password / MFA reset function (least privilege, fully logged).
• Provision and manage endpoints and MDM for Chromebook / Chrome Enterprise devices.
• Issue, inventory, and track FIDO2 security keys (two per user) and manage lifecycle / replacement.
• Lead user onboarding, joiner-mover-leaver actions, and migration of users and data into the enclave.
• Deliver end-user security awareness and CUI-handling training sessions.
• Maintain security hygiene: patch verification, asset tracking, and ticket documentation.
• Escalate significant security events to the ISSO & Security Operations Lead per the incident-response runbooks.

What you bring to the role:

• 7+ years of experience with 5+ years administering Google Workspace Enterprise Plus (or equivalent) at scale, including direct end-user / service-desk support experience.
• Bachelor's degree or higher in cyber security, computer science/engineering, management of information systems or similar degrees.
• Hands-on experience with AWS (GovCloud preferred), Amazon WorkSpaces / VDI, and Chrome Enterprise - both administration and provisioning/support.
• Strong identity background: SAML SSO, FIDO2/WebAuthn, conditional/context-aware access, and MFA / hardware-key lifecycle management.
• Configuration-baseline, hardening, and change-management discipline; scripting/automation skills.
• Backup/restore and operational resilience experience.
• Strong customer-service skills and disciplined ticket / asset documentation practice.

Preferred Certifications and Qualifications

• Google Workspace Administrator certification.
• AWS SysOps Administrator or AWS Security Specialty (helpful).
• CompTIA Security+ and/or CompTIA A+.

Citizenship, Screening and Trust

• U.S. citizenship is required (CUI access and Security Protection function).
• Must pass Ingram Micro background screening and complete CUI handling, insider-threat, and incident-handling training before access.
• Subject to least-privilege access controls and periodic access recertification; the dual compliance-owner / operator scope of this role is independently validated via the third-party KPMG / C3PAO assessment.

Work Model & Conditions

Full-time exempt role based in the U.S.. Occasional travel for the C3PAO assessment and audit activities. Standard business hours with a scheduled on-call rotation for after-hours Sev1/2 incident escalation; extended hours possible during active incidents or the C3PAO assessment window.

The typical base pay range for this role across the U.S. is USD $133,400.00 - $226,800.00 per year.

The ranges above reflect the potential annual base pay across the U.S. for all roles; the applicable base pay range will depend on the candidate's primary work location, pay grade, and variable compensation plan. Individual base pay within each range depends on various factors, in addition to primary work location, such as complexity and responsibility of role, job duties/requirements, and relevant experience and skills. Base pay ranges are reviewed and typically updated each year. Offers are made within the base pay range applicable at the time of hire. New hires starting base pay generally falls in the bottom half (between the minimum and midpoint) of a pay range.

At Ingram Micro certain roles are eligible for additional rewards, including merit increases, annual bonus or sales incentives and long-term incentives. These awards are allocated based on position level and individual performance. U.S.-based employees have access to healthcare benefits, paid time off, parental leave, a 401(k) plan and company match, short-term and long-term disability coverage, basic life insurance, and wellbeing benefits, among others.

This is not a complete listing of the job duties. It's a representation of the things you will be doing, and you may not perform all these duties.

Please be prepared to pass a drug test and successfully pass a pre-employment (post offer) background check.

Ingram Micro Inc. is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or any other protected category under applicable law.