The role

You will be the IT engineer for our client's managed IT clients. At launch that is three venture-backed technology companies. You own their IT end to end: identity, device management, endpoint security, the secure browser, the SaaS stack, and the help desk that sits on top of it. There is no one behind you doing the hands-on work, and no separate help desk under you yet. That is the point: we are hiring someone who can run the whole thing well.

The biggest share of the work is identity and access management. We wire up Okta for each client, integrate their applications, and build the joiner, mover, and leaver automation so that every new hire has the right entitlements from day zero and every departure is fully cut off. Around that, you administer Island Enterprise Browser, deploy and manage CrowdStrike Falcon, keep devices enrolled and compliant in MDM, and answer the day-to-day requests from each client's staff.

A rough split: half your time on identity and automation, a quarter on endpoints and security tooling, and a quarter on help desk and onboarding. What ties it together is automation. We want someone who sees a repeated task and builds the workflow, script, or policy that makes it go away.

This role is how we grow the practice. If it goes well, we take on more IT clients and add a dedicated help desk hire who works under your direction.

What you will own

IDENTITY AND ACCESS (OKTA)

- Stand up and maintain Okta for each client: HRIS as source of truth (Rippling, HiBob, BambooHR, Gusto), profile mappings, groups and group rules, authentication policies, and MFA.
- Integrate client applications with SSO (SAML and OIDC) and, wherever the app supports it, SCIM provisioning. Where it does not,



build the next best thing and document it.
- Design birthright access by role, department, and location so a new hire's entitlements are correct on day zero without anyone asking.
- Keep a per-client identity map: every app, how it is provisioned and deprovisioned, who owns it, and which ones still need manual steps.

WORKFLOWS AND AUTOMATION

- Build and maintain joiner, mover, and leaver automation with Okta Workflows and the APIs of the tools our clients already own.
- Automate across the stack, not just identity: device assignment and enrollment, Island and CrowdStrike policy assignment by group, license reclamation, and access review exports.
- Script where Workflows run out: Python, PowerShell, or Bash against REST APIs. Infrastructure as code (the Okta Terraform or Pulumi provider) is a plus.
- Push manual steps toward zero. Every one you remove is one less way for access to linger or a step to be missed.

OFFBOARDING THAT HOLDS UP

- Own offboarding end to end: deactivate in the identity provider, confirm every downstream app received the deprovision, revoke active sessions (including mobile), lock and recover the device, and close out the apps that sit outside SSO.
- When a deprovision does not land, find out why from the logs and fix the integration so it does not happen again.



Treat every miss as a root cause to remove.

ENDPOINTS AND SECURITY TOOLING

- Administer Island Enterprise Browser: tenant configuration, identity integration, browser policies (data loss controls, extension management, access rules), rollout to users, and troubleshooting.
- Deploy and manage CrowdStrike Falcon: sensor rollout through MDM, prevention and update policies, host groups, staged pilot then fleet rollouts, and ML exclusions for developer tooling without opening visibility gaps.
- Manage macOS fleets in MDM (Kandji, Jamf, or Intune): enrollment, baselines, OS and app updates, preinstalled apps, managed browser extensions, and device compliance.
- Work alongside our security team when an alert or incident has an IT component: isolate a host, pull a device, reset access.

HELP DESK AND ONBOARDING

- Answer client IT requests in Slack and in the ticket queue during business hours: access, MFA resets, SSO errors, device issues, and "I cannot get into X." Acknowledge quickly and drive each one to closed.
- Run first-day onboarding calls with new hires: Okta sign-in, MFA, Island, core apps, and where to go for help. Confirm everything works before you hang up.
- Administer the common SaaS layer: Google Workspace, Microsoft 365, Slack, Zoom, 1Password, and the long tail of tools each client runs.

COMPLIANCE SUPPORT

- Produce the IT evidence our GRC team needs: user access reviews, onboarding and offboarding records, MFA and SSO coverage, device compliance, and EDR coverage.
- Work with Rovally's GRC analysts when an audit control touches IT, so the configuration and the evidence match.

TRACKING AND STATUS

- Track every

📌 IT Operations Administrator (Colombia)
🏢 Outsourced
📍 Colombia