Responsibilities:
End-User Support & IT OperationsPrimary internal point of contact for all hardware, software, connectivity, and access issues across on-site and remote employeesManage the MSP relationship: define what goes to them, hold them to SLAs, and escalate appropriately Manage the full device lifecycle: procurement, imaging, deployment, and decommissioning Administer Microsoft 365: Entra ID, Exchange Online, SharePoint, Teams, OneDrive, and associated licensesOwn IT onboarding and offboarding workflows, account provisioning, device assignment, access revocation, and litigation hold procedures; this process must be airtight and documentedMaintain a current IT asset inventoryCybersecurity & Information SecurityHandle the organization's day-to-day security posture; engage the MSP for complex security projects and escalationsAdminister endpoint protection, patch management, MFA enforcement, and conditional access policiesMonitor M365 security and compliance tooling: Purview, Defender for Business, audit logsConduct periodic access reviews and permission audits; produce findings reports for managementLead first-response on security incidents: containment first, investigation second and coordinate MSP escalation where needed; this includes employee departure scenarios involving potential data exfiltrationManage email authentication controls (SPF, DKIM, DMARC) and anti-phishing policiesManage security and access governance for AI/LLM tools in use across the org, enforce least-privilege access, MFA, and conditional access on AI service accounts, app registrations, and admin rolesGate and process access requests for AI infrastructure (Azure OpenAI, Entra app registrations, Key Vault, etc.) submitted by AI/data engineering staff, approve or deny per policy, and escalate architecture or capability decisions to the appropriate technical ownerSupport enforcement of the company's AI usage policy, approved tools, data classification for AI inputs, and prohibition of unsanctioned "shadow AI" tools in coordination with outside AI policy/training vendorsLab & Instrument ITMaintain network connectivity for laboratory instruments and manage isolated VLANs where requiredServe as the IT interface for lab instrument vendors and cloud-connected instrument platforms (e.g., SaaS-connected analytical instruments, vendor cloud dashboards) Administer and secure internally hosted lab/process data systems including server-level access control, patching, and credential lifecycle management, with access revoked immediately upon staff or contractor departureKeep instrument computing hardware and software licensesAccess & Device GovernanceDeploy and administer an MDM solution across the full device fleetHandle permissions governance for end-user systems: M365, SharePoint, shared drives, and SaaS applicationsManage data lifecycle for off-boarded employees including legal preservation requirementsCloud Cost & Vendor ManagementMonitor cloud and SaaS spend; surface optimization opportunities and eliminate unused licensesManage all software subscriptions across office and lab environments licenses, renewals, utilization tracking, and vendor relationships for both business software and laboratory-specific applicationsCoordinate with the Data Infrastructure Engineer on cloud access provisioningTrack IT vendor contracts and MSP deliverables; flag renewal dates and surface consolidation opportunitiesIT Policy & DocumentationMaintain core IT policies: Acceptable Use, Data Classification, Password PolicyDocument processes and configurations well enough that someone else could operate themQualifications3–5 years of hands-on IT experience in a generalist roleMicrosoft 365 administration: Entra ID, Exchange Online, SharePoint, Intune/MDMEndpoint security: patch management, MFA/conditional access, Defender for Business or equivalentExperience managing network hardware: switches, enterprise Wi-Fi, firewall rulesMDM deployment and administration experience (Intune, Jamf, or Kandji) Strong documentation disciplineClear communicator with both non-technical staff and external technical partnersPreferred: exposure to securing AI/LLM tooling and cloud AI services access governance and conditional access, not AI/ML developmentPreferred: experience with networked lab/scientific instrumentation and vendor-managed cloud platforms
