IT Infrastructure Architect

We are seeking a seasoned IT Infrastructure Engineer to join our team. As a key member of our Corporate IT Services group, you will be responsible for the technical ownership of our employee-facing SaaS stack, including Google Workspace, Okta, Slack, Jamf, and JumpCloud.

Key Responsibilities:

• Plan, test, and implement enhancements in Google Workspace, Okta, Slack Enterprise, Jamf, JumpCloud, and other SaaS tools—ensuring zero-downtime rollouts and clear stakeholder communication.
• Evaluate and enable new features released by existing vendors; build proof-of-concepts, run pilots with power users, and document best practices so that teams can adopt functionality quickly and safely.
• Lead M&A integrations by migrating or consolidating user directories, Corporate IT Tools, and device management policies for acquired companies.
• Enable newly selected SaaS platforms by configuring SSO/SCIM integrations, Okta Identity Governance policies and workflows, publishing self-service deployments in Jamf/JumpCloud, and documenting associated automations.

License & Lifecycle Management:

• Own renewals and true-ups for every Corporate IT-managed subscription (Google, Okta, Slack, Jamf, LastPass, JumpCloud, etc.), preventing surprise overages.
• Monitor license utilisation proactively, maintaining a healthy buffer for new hires while eliminating dormant accounts to control cost.
• Execute full lifecycle management of Corporate IT Tools —procurement, renewal, replacement, and sunset—driving cross-functional communication so end-users experience seamless transitions.
• Assist other departments in safely decommissioning sunset tools, exporting historical data, and ensuring compliance retention requirements are met.

Endpoint Security & Software Management:

• Publish security patches immediately via Jamf (macOS) and JumpCloud / Intune (Windows), following a quarterly OS upgrade calendar validated through pilot testing.
• Maintain a catalog of 50+ approved applications, pushing or making available the latest versions through Jamf Self Service and JumpCloud software policies.
• Define configuration baselines to meet PCI DSS, ISO 27001, and SOC 2 controls, collaborating with Security on hardening benchmarks and DLP enforcement.

Automation & Scripting:

• Design no-/low-code workflows using Okta Workflows, Google Apps Script, Zapier, n8n, etc., eliminating repetitive manual tasks and reducing MTTR for support tickets.
• Write Bash/Shell Scripts and PowerShell code to support various policy enforcement in macOS and Windows

Support for IT Compliance, Audit & Incident Response:

• Support the IT Compliance Team by setting up automations and alerts required for controls and internal policies, internal audits and reviews.
• Support to investigate DLP and security alerts across Google, Okta, macOS, Windows, and Slack, coordinating incident response with IT Compliance and Security and remediating root causes.
• Support IT Compliance in closing non-conformities quickly—driving permanent fixes through policy updates, scripting, or new automation.

Required Skills & Experience:

• 4+ years administering Google Workspace and Okta Workforce Identity in a 1,000+ endpoint, multi-OS SaaS environment.
• 2+ years hands-on with Okta Workflows, Identity Governance, and Device Access.
• 2+ years managing Jamf Pro or an equivalent macOS MDM.
• Solid background administering Slack Enterprise Grid.
• Automation & Scripting skills: Strong Bash/Shell for macOS and PowerShell for Windows.
• Comfortable with JavaScript or Python for API integrations.
• Proven record of building no-/low-code automations (Okta Workflows, Apps Script, Zapier, n8n, etc.).
• Security & Compliance skills: Practical knowledge implementing PCI DSS, ISO 27001, and SOC 2 controls in identity and endpoint platforms.
• Experienced handling compliance audits and security incidents.

Nice-to-Have:

• Certifications: Okta Certified Administrator/Consultant, Okta Certified Workflows, Associate Google Workspace Administrator.
• Familiarity with ITIL / ITSM and CMDB practices using Freshservice or similar