IT Systems Engineer

ROLE OVERVIEW

We are looking for a hands-on IT Systems Engineer to own and operate the technology backbone that keeps Metadome.ai's teams productive, connected, and secure.

You will be responsible for identity and access management, endpoint security, networks, cloud workspace administration, IT operations, and information security compliance across a multi-location organization. This is a high-ownership builder-operator role focused on maintaining reliable systems while continuously strengthening Metadome.ai's GDPR, SOC 2, and ISO 27001 posture.

RESPONSIBILITIES

Identity & Access Management

• Own the JumpCloud directory end-to-end, including user lifecycle, groups, and organizational structure.

• Administer SSO, MFA, conditional access, and device-based access policies across SaaS applications.

• Manage device policies across macOS, Windows, and Linux, including encryption and compliance baselines.

• Integrate RADIUS / LDAP for Wi-Fi and application authentication.

• Automate onboarding and offboarding to ensure least-privilege access and auditable deprovisioning.

Google Workspace Administration

• Administer the Google Workspace tenant, including users, groups, organizational units, and email routing.

• Configure and enforce 2-Step Verification, context-aware access, DLP, and sharing policies.

• Manage retention, eDiscovery, and legal holds through Google Vault.

• Optimize Workspace licensing and SaaS spend.

Endpoint & Threat Protection

• Deploy, configure, and manage Sophos Central, Intercept X, and XDR across endpoints and servers.

• Monitor alerts, triage threats, and lead incident detection, response, and remediation.

• Maintain endpoint encryption, web/application controls, and device-hardening standards.

• Manage Sophos Firewall policies, IPS, and secure remote access where applicable.

Network, Firewall & Wi-Fi

• Design, configure, and maintain firewalls, VLAN segmentation, VPN, and secure remote access.

• Administer enterprise Wi-Fi and wired networks, including switches and access points.

• Manage LAN/WAN connectivity, ISP relationships, and network performance and uptime.

• Implement network monitoring, intrusion detection, and centralized logging.

Hardware, Software & Asset Management

• Own the complete hardware lifecycle, including procurement, provisioning/imaging, maintenance, repair, and decommissioning.

• Support a mixed fleet of macOS, Windows, and Android devices, including high-performance workstations and XR/VR hardware.

• Maintain accurate hardware and software inventories and asset registers.

• Manage software deployment, patch management, and license compliance.

Security, Risk & Compliance

• Operate and continuously improve the company's Information Security Management System (ISMS).

• Own day-to-day compliance across GDPR, SOC 2 Type II, and ISO/IEC 27001, including control implementation, evidence collection, and continuous monitoring.

• Conduct risk assessments, internal audits, periodic access reviews, and vendor security/DPA assessments.

• Serve as a primary point of contact during external audits and customer security reviews.

• Maintain security policies, RoPA, DPIAs, and incident/breach-response runbooks.

• Drive security-awareness and phishing-simulation programs across the organization.

IT Operations & Support

• Ensure 24x7 high availability of core systems and meet defined uptime and SLA metrics.

• Provide escalation-level troubleshooting across macOS, Windows, and Android.

• Manage backups, disaster recovery, and business-continuity testing.

• Coordinate internal teams and third-party vendors to deliver IT projects on time and within budget.

• Maintain documentation, runbooks, and standard operating procedures.

• Own and report on the IT budget and asset allocation.

REQUIREMENTS

Experience & Background

• 5+ years in IT systems/infrastructure engineering with direct, hands-on ownership.

• Demonstrated hands-on expertise with JumpCloud across identity, SSO, MFA, and device management.

• Deep Google Workspace administration experience, including security, DLP, and Vault.

• Hands-on Sophos endpoint/XDR administration and threat response experience.

• Strong networking experience covering firewalls, Wi-Fi, VLANs, VPN, LAN/WAN, and RADIUS/LDAP.

• Hands-on experience with GDPR, SOC 2, and ISO 27001, including at least one full audit/certification cycle.

• Proven troubleshooting experience across macOS, Windows, and Android in a 24x7, multi-location environment.

• Strong understanding of IDS/IPS, endpoint hardening, encryption, and backup/recovery.

• B.Sc. / B.Tech in Information Technology, Computer Science, or a related discipline.

• Strong documentation discipline, ownership, resourcefulness, and structured problem-solving approach.

TOOLS & TECHNOLOGIES

Core Stack

• JumpCloud — Identity, SSO, MFA & Device Management

• Google Workspace / Google Vault

• Sophos Central / Intercept X / XDR

• Firewalls, VLANs, VPN, Wi-Fi, LAN/WAN

• RADIUS / LDAP

• IDS / IPS and centralized logging

• macOS, Windows, and Android

• IT asset and software management systems

Good to Have

• Relevant certifications such as ISO 27001 Lead Implementer/Auditor, CompTIA Security+/Network+, or JumpCloud/Sophos certifications.

• Experience with compliance automation platforms such as Sprinto, Vanta, or Drata.

• Scripting and automation using Bash, PowerShell, or Python.

• Experience in a fast-paced SaaS or technology company serving enterprise and global clients.

• Familiarity with supporting creative, 3D, or XR workflows and high-performance computing environments.

WHAT WE OFFER

You will own the systems and security posture of a company building category-defining immersive technology for some of the world's most recognizable brands.

This is a high-trust, high-ownership role with the autonomy to design things properly — and the visibility that comes with keeping a security- and compliance-first business running flawlessly.

HOW TO APPLY

To apply, send your résumé and a brief note on a compliance program (GDPR, SOC 2, or ISO 27001) you have personally implemented to [HIDDEN TEXT].