medely - IT Systems Administrator

• 1) IDENTITY & ACCESS MANAGEMENT (OKTA-FIRST) • Own Okta as the control plane: SSO (SAML/OIDC), SCIM provisioning, group rules, profile/attribute mapping, authentication policies, MFA/FastPass, and admin role scoping • Drive Okta to be the single source of provisioning for every eligible app; migrate remaining Rippling-provisioned apps and configure SCIM where supported but unused • Design and maintain RBAC by department, role, and seniority; publish and maintain access control matrices • Build birthright access, time-bound access (e.g., international travel), and automatic revocation • Govern service and shared accounts: inventory, ownership, conversion to named accounts, credential rotation • Run recurring access reviews and produce audit-ready evidence for SOC 2 and security reviews • Partner with Security on zero-trust posture, device admission, geofencing, and Okta system log monitoring • 2) AUTOMATION, WORKFLOWS & INTEGRATIONS • Design, build, and maintain automations in n8n, Okta Workflows, and our ticketing platform, connecting Okta, Rippling, Ashby, the ticketing platform, Slack, Google Workspace, Notion, and business apps • Use REST APIs, webhooks, OAuth/API tokens, and JSON payloads confidently; read vendor API docs and build reliable integrations with error handling, retries, logging, and alerting • Automate the employee lifecycle end to end: pre-hire prep, staged Okta creation and timed activation, Day-1 access, role/department changes, and offboarding with access revocation and audit trail • Partner closely with HR / People Ops on lifecycle management: agree on HRIS data standards and trigger timing, coordinate start dates, role changes, leaves, and terminations (including sensitive or same-day exits), and handle HR data with discretion • Turn access requests into self-service catalog items with approval routing by app sensitivity (Slack approve/deny, owner approvals, automatic provisioning on approval) • Treat automations as production systems: version control or exportable definitions, documentation, runbooks, credential hygiene, least-privilege service accounts, and ownership • 3) DEVICE MANAGEMENT (MACOS & WINDOWS) • Our fleet is roughly 85% macOS and 15% Windows. Mac is the default, but Windows users get the same level of support, security, and polish. • Own MDM across macOS and Windows (Iru; experience with Kandji, Jamf, and/or Intune expected): enrollment (ABM/ADE, Autopilot), blueprints/profiles, compliance baselines, patching, app deployment, and FileVault/BitLocker • Maintain and extend Okta Device Trust (device identity certificates, managed-device attestation, desktop and mobile auth policy rules) • Harden enrollment controls so factors and devices can only be enrolled from managed, compliant hardware • Own hardware lifecycle tooling and data: assignment, shipping, recovery, resale/disposal, and reconciliation with Finance • 4) IT OPERATIONS & SERVICE EXCELLENCE • Serve as frontline support for Medely Help (our ticketing platform): identity, device, SaaS, and cross-system issues • Handle the occasional hands-on fix with care: password/MFA resets with proper identity verification, break/fix troubleshooting, and remote machine replacement (ship, wipe, re-enroll, recover) • Own ticketing platform configuration: request catalog, forms, routing, categories, SLAs, inbox boundaries (privacy-aware for HR/sensitive queues), and AI triage behavior • Maintain a strong Helpdesk Knowledge Base and IT internal runbooks in Notion • Help build sustainable IT operating rhythms: roadmap hygiene, weekly status, ownership on every card, and visible deadlines • 5) ZOOM & ZOOM PHONE ADMINISTRATION • Own Zoom Workplace administration: Okta SSO and SCIM provisioning, license types and assignment, roles, groups, account- and group-level settings and locks, and add-on management • Manage meeting and recording policy: cloud recording settings, retention, sharing defaults, and access controls aligned with Security and Legal • Govern Zoom AI Companion and other AI features: who has them, what's enabled, and how summaries and recordings are stored and shared • Administer Zoom Phone end to end: number inventory and assignment, porting, call queues, auto receptionists/IVR, business hours and holiday routing, voicemail, and call handling for operational teams • Own Zoom Phone compliance and reliability: emergency (E911) addresses, call recording policies and notices, SMS/10DLC registration, and call quality troubleshooting • Build Zoom and Zoom Phone into the employee lifecycle: automatic license and number assignment on hire, call queue and routing updates on role changes, and number reclamation, recording handoff, and license recovery on offboarding • Track Zoom usage and licenses to right-size seats and Zoom Phone plans at renewal • 6) SAFE AI ENABLEMENT • Enable AI tools (Claude, Notion AI/agents, and new entrants) through Okta SSO/SCIM, group-based entitlements, usage controls, and approval workflows • Build AI-assisted IT workflows (ticket triage, KB drafting, access request intake, reporting) with human-in-the-loop checkpoints where risk warrants • Design, build, and maintain governed AI integrations using LLM APIs (Anthropic/OpenAI), MCP connectors, and AI agents (including Notion agents and n8n AI nodes), with scoped credentials, data boundaries, logging, and clear ownership • Put safeguards in place for every employee using AI tools: approved-tool list, data classification guidance (what never goes into a prompt: PII, PHI, credentials, customer data), connector and integration scoping, admin settings like data retention and training opt-outs, and audit logging • Make safe use the easy path: short, practical guidance and training in Notion, a clear request path for new AI tools, and fast reviews so people don't route around IT • Partner with Security and Legal on AI acceptable-use policy, vendor reviews, and periodic checks of how AI tools are actually being used • 7) SAAS GOVERNANCE & SHADOW IT (TORII) • Own Torii as the system for SaaS discovery: find unsanctioned apps, OAuth grants, and browser-extension sign-ups, and triage them (approve and bring under Okta, replace with a sanctioned tool, or shut down) • Assign a business owner to every app and keep the SaaS inventory current • Use Torii usage for automated license reclamation and consolidation • Build automations off Torii signals (new app detected, unused licenses, upcoming renewals) into the ticketing platform, Slack, and Notion • 8) SECURITY OPERATIONS MINDSET • Apply least privilege and zero-trust principles to every system you touch, including your own admin access and automation service accounts • Monitor Okta System Log and admin activity; investigate suspicious sign-ins, unexpected factor enrollments, and policy failures with Security • Keep secrets out of tickets, Slack, and workflows; use 1Password and scoped API tokens, and rotate credentials • Administer 1Password: Okta-integrated provisioning, vaults and shared-vault structure by team, groups and permissions, policies, recovery and reporting • Support incident response: document, contain, and run post-incident follow-ups that close the underlying control gap • Help with security awareness for employees (phishing, MFA hygiene, device hygiene) and support Security on SOC 2 controls and evidence • 9) SYSTEMS & DATA ARCHITECTURE • Design clean, relational IT data in Notion (and connected sources): SaaS inventory and status, app ownership, access matrices, asset inventory, roadmap, and ticket insights • Define sources of truth and sync patterns between HRIS (Rippling), identity (Okta), ticketing platform, and Notion so reporting is accurate and automatable • Build dashboards and metrics: ticket volume and categories, time to resolve, provisioning coverage, SCIM coverage, device compliance, license utilization, and SaaS spend • Support SaaS audits, renewals, and license reclamation with real usage data • 10) NOTION PLATFORM OWNERSHIP • Administer Notion as a core company platform: teamspaces, permissions and sharing patterns, SCIM/SSO, databases, forms, automations, and AI agents • Help departments build in Notion without oversharing or shadow IT; set standards and templates • WHAT SUCCESS LOOKS LIKE • Fully onboarded on Okta, Iru, the ticketing platform, n8n, and Notion admin; owns a defined set of IT Roadmap workstreams with weekly deadlines met • Delivers a provisioning gap report: every app's SSO / SCIM / provisioning source / shared-account status, with a remediation plan • Ships at least 2–3 production automations that measurably remove manual ticket work (e.g., top app access requests) • Completes a Torii shadow-IT review: every discovered app is triaged, has an owner, and is either sanctioned under Okta or retired • Audits Zoom and Zoom Phone: license and number inventory, call queue and routing map, E911 addresses, and recording settings, with fixes for any gaps • Okta is the provisioning source for all eligible apps; Rippling-provisioned gaps closed • Access requests for top apps are self-service with policy-based approvals and auto-provisioning • Onboarding/offboarding is triggered, timed, and audited end to end • Ticket deflection and time-to-resolve trend in the right direction, with a monthly ticket insights report • Quarterly access reviews are automated and audit-ready • Device compliance and device trust coverage near 100% across macOS and Windows • IT operational data (SaaS, access, assets, tickets) is trusted and powers dashboards and AI-assisted workflows