IT & Information Security Manager

About the Role

EHS Insight is looking for an IT & Information Security Manager to own our IT operations in a fully remote, cloud-only environment. This role is responsible for administering our Microsoft 365 tenant, managing endpoint security and device lifecycle for a distributed workforce, enforcing security and compliance standards, and serving as the primary point of contact for all internal IT needs. This position reports to the Chief Executive Officer.

This is a hands-on, single-owner role. You will set the strategy and also do the work: closing tickets, imaging and shipping laptops, running the access reviews, and writing the policies you then enforce. There is no team beneath you and no managed service provider behind you. If that mix appeals to you, you will have unusual latitude to build the function the way you think it should be built.

How This Role Works

We are a small company and the structure around this role is deliberate, so we would rather describe it up front than let you discover it in month three.

• You report directly to the CEO. We have no COO or VP of Operations today, so this keeps the line short while security remediation is the priority. We expect the role to move under an operations leader as we grow, and we would rather tell you that now than surprise you with it later.
• You partner closely with our Director of Compliance, who owns our relationships with our external security assessor and our ISO auditors. They define what has to be true; you decide how we make it true. They are deliberately not your manager — we keep implementation and assurance in separate reporting lines so that our internal audits stay independent.
• Funding and risk-acceptance decisions are made by a cross-functional security steering group that meets quarterly. You bring the analysis and the recommendation; the group owns the decision. You will not be left holding a risk acceptance on your own.
• Day-to-day IT support is handled today by the CEO and our VP of Customer Success, and the volume is genuinely light. You are inheriting a small queue, not a backlog.

What You'll Do

Microsoft 365 & Cloud Identity Administration

• Administer the Microsoft 365 tenant end to end (Exchange Online, SharePoint, OneDrive, Teams), including tenant-level security, sharing, and external-collaboration configuration
• Own Entra ID: user and group lifecycle, role assignment and privileged access separation, password and account lockout policy, organizational domain verification, and app registrations
• Manage Microsoft 365 licensing and entitlement, including right-sizing SKUs as headcount changes
• Support Exchange Online: mail flow, SPF/DKIM/DMARC, quarantine and filtering rules, and mailbox recovery and restore testing
• Administer Dropbox: sharing controls, external link governance, and periodic access review

Endpoint & Device Management

• Administer Intune for device enrollment, compliance policies, and configuration profiles
• Oversee endpoint security: BitLocker, Defender for Endpoint, and patch/update management via Intune
• Manage device lifecycle (procurement, shipping logistics for remote employees, retirement/wiping of returned hardware)
• Govern access from personally owned phones and tablets through Mobile Application Management (MAM) and device-compliance gating, containerizing company data on devices we do not own

Backup, Recovery & Business Continuity

• Own backup and recovery for all corporate cloud data, including independent third-party backup of Microsoft 365 (mail, SharePoint, OneDrive) and Dropbox file data
• Define, document, and routinely test restore procedures — mailbox-level, file-level, and full-tenant — and keep evidence of every test
• Maintain and annually test the Business Continuity and Disaster Recovery plans for corporate systems
• Monitor backup jobs, respond to failures, and report on recovery readiness

Security & Compliance

• Implement and enforce security policies via Entra ID Conditional Access, Defender for Office 365, and Defender for Endpoint
• Manage data loss prevention, retention policies, and compliance requirements
• Monitor security alerts (Microsoft Defender, Entra ID sign-in logs) and lead initial incident response
• Own our response to external audits, customer security questionnaires, and cyber insurance renewals, and support our compliance frameworks (SOC 2, ISO 27001, and ISO/IEC 42001 for AI management)
• Develop internal IT policies & procedures
• Drive remediation of findings from our annual third-party cyber risk assessment, tracking each finding to closure with documented evidence
• Deploy and manage web content and DNS filtering across all corporate endpoints
• Plan and facilitate annual incident response tabletop exercises, including AI-related incident scenarios

SaaS & Third-Party App Integration

• Manage SSO integrations between Entra ID and third-party SaaS applications
• Provision and manage SaaS applications
• Evaluate, onboard, and manage SaaS vendors and tools used across the org

AI Systems & Governance

• Administer the identity layer for our AI platforms: SSO federation, SCIM-based automated provisioning and deprovisioning, and verification of our organizational domains
• Implement technical controls over AI tool usage, including restricting unapproved (“shadow”) AI services and governing what local data desktop AI tools can reach
• Enforce acceptable-use and data-sharing policy for AI tools, including controls over internal sharing of chat logs and AI output
• Support our AI governance committee with the approved-tool inventory, access reviews, and vendor risk assessments

Helpdesk & Remote End-User Support

• Serve as internal IT support (remote-first support model)
• Manage onboarding/offboarding processes (account provisioning, device shipping/setup, access/license assignment)
• Troubleshoot Teams, Outlook, and general hardware/software issues via remote tools
• Support virtual meeting/AV setup guidance for employees (headsets, webcams, home office equipment standards)
• Own the ticket queue day to day. There is no tier-1 layer beneath this role due to low volume, and no request is beneath it either

Vendor & Budget Management

• Manage relationships with Microsoft (CSP/reseller), SaaS vendors, and hardware/shipping suppliers
• Track software licensing costs and identify optimization opportunities
• Recommend new tools/features within the Microsoft ecosystem to improve efficiency and security

Strategy & Leadership

• Develop and maintain IT roadmap aligned with business growth, focused on cloud-first, remote-friendly solutions
• Report IT and security risk posture to leadership: remediation progress, residual risk, and recommendations on which risks to accept versus fund

Your First 12 Months

This role comes with a clear mandate and in your first year, you will:

• Take ownership of our Microsoft 365, Intune, and Entra ID configuration, and continue moving our security standards from documented policy to technically enforced control
• Strengthen our backup, recovery, and business continuity program, including regular tested restores
• Extend centralized identity and access governance across our SaaS and AI platforms
• Partner with our Director of Compliance to advance our security roadmap ahead of our next annual assessment

We will walk you through the detailed roadmap and current priorities during the interview process.

What We're Looking For

• 5–8+ years of experience administering Microsoft 365 and Entra ID (Azure AD) environments, including at least one tour as the senior or sole IT owner
• Hands-on experience with Intune/Endpoint Manager for device and application management
• Strong understanding of identity security concepts: Conditional Access, MFA, SSO, and least privilege access
• Experience supporting a fully remote workforce and managing distributed device logistics
• Familiarity with Microsoft Defender for security and compliance
• Excellent troubleshooting and communication skills; comfortable being the sole or leading IT resource
• Familiarity with ISO/IEC 42001, NIST CSF, or comparable AI and security governance frameworks a plus
• 2+ years in an environment subject to SOC 2, ISO 27001, or comparable external audit — you have been on the hook for producing evidence, not just aware that audits happen
• Demonstrated ownership of backup and recovery for cloud-hosted data, including running restore tests rather than trusting the dashboard
• Experience managing identity for SaaS and AI platforms (SSO federation, SCIM provisioning, domain verification), or a clear track record of picking up new platforms quickly
• Genuinely comfortable with unglamorous work. You are the person who ships the laptop, resets the password, and then writes the runbook so it does not come back

Preferred Certifications

Any combination of the following is welcome; we do not expect candidates to hold all of them.

• MS-102: Microsoft 365 Administrator
• SC-300: Microsoft Identity and Access Administrator
• MD-102: Endpoint Administrator
• SC-200: Microsoft Security Operations Analyst
• AZ-500: Azure Security Engineer Associate (or equivalent security depth)

Compensation

Annual base salary of $135,000–$170,000, based on relevant experience and qualifications.

Benefits

• Flexible PTO
• Six weeks of paid parental leave for exempt, full-time employees
• Medical, dental and vision coverage — including an employee-only medical option with premiums fully paid by the company
• Teladoc virtual healthcare services
• Employer-paid short-term and long-term disability coverage
• Employer-paid life insurance
• 401(k) with employer match
• Access to legal services and additional voluntary benefits
• Fully remote work environment

Equal Opportunity Employer

EHS Insight, a StarTex Software brand, is an equal opportunity employer. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by applicable law.