Tech stack you’ll work with

About the role

You will be the go-to person for Google Workspace, Jamf, Jira, GitHub and our Wazuh SIEM, and you will work closely with engineering, security and compliance. In a regulated fintech environment, that means getting the details right: least-privilege access, auditable changes and fast response when something looks wrong.

Key responsibilities

Administer Jamf Pro for the full macOS (and iOS, where applicable) fleet: enrollment, zero-touch provisioning via Apple Business Manager, and offboarding.
Build and maintain configuration profiles, policies and smart groups for FileVault encryption, firewall, screen lock, Gatekeeper and OS update enforcement.
Deploy and patch applications, and keep the fleet aligned with CIS benchmarks.
Manage hardware inventory, device lifecycle and remote lock or wipe for lost or compromised devices.
Administer Google Workspace as the primary identity provider: users, groups, organizational units and SSO (SAML/OIDC) to connected apps.
Enforce MFA (security keys or passkeys preferred), password policies, context-aware access and session controls.
Own joiner, mover and leaver processes, with access granted on least-privilege and role-based principles.
Run periodic access reviews and keep auditable records of approvals and changes.
Configure Gmail security (SPF, DKIM, DMARC), DLP rules and Drive sharing restrictions.
Administer Jira: projects, workflows, permission schemes, user provisioning and integrations.
Administer the GitHub organization: teams, repository permissions, SSO enforcement, branch protection rules and required reviews.
Manage GitHub security features such as secret scanning, Dependabot and audit log monitoring, in partnership with engineering.
Operate and maintain Wazuh: agent deployment across endpoints and servers, rule tuning and log source onboarding (Google Workspace, GitHub, cloud and network logs).
Triage alerts, investigate suspicious activity and escalate or handle incidents following our response runbooks.
Use Wazuh for file integrity monitoring, vulnerability detection and compliance reporting.
Manage the corporate VPN or zero-trust network access solution, including client deployment, access policies and certificate management.
Maintain office network infrastructure: Wi-Fi (WPA3-Enterprise), firewall rules, network segmentation and guest isolation.
Implement and document security controls that support our compliance obligations (for example SOC 2, ISO 27001, PCI DSS, DORA and GDPR).
Collect evidence for audits and help answer security questionnaires from partners and regulators.
Write and maintain IT policies, runbooks and system documentation.
Run security awareness basics, such as phishing simulations and onboarding training.
Provide day-to-day IT support to employees, and onboard new joiners with a ready-to-use, secure setup on day one.
Evaluate, purchase and manage SaaS tools and licenses, keeping costs and shadow IT under control.

Required qualifications

3+ years in IT administration or systems administration, ideally in a fast-growing or regulated company.
Hands-on experience administering Google Workspace, including SSO, MFA, groups and security settings.
Hands-on experience with Jamf Pro (or a comparable MDM) managing a macOS fleet.
Working knowledge of Jira and GitHub administration: permissions, SSO and user lifecycle.
Experience with a SIEM (Wazuh strongly preferred) and basic incident triage.
Solid networking fundamentals: TCP/IP, DNS, DHCP, VLANs, firewalls and VPN technologies.
Comfort with scripting for automation (Bash, Python or similar) and with APIs.
A security-first mindset: least privilege, change control, documentation and audit trails.
Clear written communication and a helpful, service-oriented attitude.
Fluent English.

Nice to have

Experience in fintech, banking or payments, and familiarity with SOC 2, ISO 27001, PCI DSS or DORA audits.
Experience with zero-trust access tools (for example Tailscale, Cloudflare Zero Trust or similar).
Cloud fundamentals on AWS, GCP or Azure, especially IAM and logging.