IT Operations Lead

Blackpoint Cyber is the leading provider of world-class cybersecurity threat hunting, detection and remediation technology. Founded by former National Security Agency (NSA) cyber operations experts who applied their learnings to bring national security-grade technology solutions to commercial customers around the world, Blackpoint Cyber is in hyper-growth mode,  fueled by a recent $190m series C round. 

What You'll Do

As IT Operations Lead, you are the operational leader for IT execution at Blackpoint Cyber and our in-house Microsoft expert. Your job is to turn CSTO-set strategy into delivered work. You are also the engineering authority for identity and access: Microsoft Entra ID is the control plane for our workforce, and you will own its architecture, security posture, and automation end to end. You will set the technical standards for our endpoint platforms (Intune and Jamf) and SaaS integrations.

This is a deeply hands-on player-coach role, and we expect the majority of your time to be spent in the technology itself. It is designed for an established senior engineer who is ready to take the next step into leadership: you will do the hardest technical work yourself while building your management skills by directing the IT Administrator and other IT staff day to day, planning and prioritizing work, and mentoring. You will support approximately 230 team members across a distributed workforce.

Key Responsibilities

Translate strategy and priorities into projects and tasks. Sequence and assign work, run weekly planning, track status, remove blockers, and report progress and risks to the CSTO.

Set daily priorities for the IT Administrator and other IT staff, review changes, coach, and author the architecture documentation, runbooks, and change standards the team follows.

Serve as the final technical escalation point for identity, endpoint, and SaaS incidents, run root cause analysis, and drive permanent fixes. Implement the platform and tooling decisions already set by leadership, with feasibility and effort estimates and the vendor and licensing tasks needed for delivery.

Own Entra ID architecture and privileged access. Design and operate Conditional Access, authentication methods, passwordless and phishing-resistant MFA, Privileged Identity Management (PIM), admin role hygiene, break-glass accounts, and delegated administration.

Govern the identity lifecycle. Use the Entra ID P2 feature set (access reviews, entitlement management, Identity Protection) and own the automated joiner, mover, and leaver flows, including the onboarding and offboarding flows.

Own SSO and application integration. Manage app registrations, enterprise applications, SAML and OIDC federation, and SCIM provisioning across Entra and Auth0, both of which remain in use. This includes Atlassian SSO and SCIM and group-based role structures such as the Claude Enterprise access layers built on Entra SCIM groups.

Own device identity. Manage Entra join and registration, including Platform SSO and Entra sign-in on macOS, and the tie between device identity, Intune compliance, and Conditional Access.

Govern external and third-party access. Own guest (B2B), contractor, agency, and vendor access patterns in Entra and Microsoft 365, including time-bound access, sponsorship, and SFTP or website access for outside partners.

Create the standard-access catalog. Maintain the access role matrix and role-based, pre-approved access bundles, plus an approval matrix, so routine requests are fulfilled by the IT Administrator without lead involvement.

Security and compliance controls

Own technical controls for CMMC Level 2. Implement and evidence the technical controls assigned to IT, such as MFA and lockout policy, MDM policies and endpoint configuration baselines, removable media controls, least-privilege and admin access, backup configurations, audit-log alerting, remote access, patch management, and system inventory and network diagrams.

Support SOC 2 Type 2 and policy governance. Remediate access-related control findings (access revocation, access to production), run periodic user access and firewall configuration reviews, review security policies (such as Access Control, Passwords, and Device Security) for technical accuracy, and review vendor intake requests from the IT perspective.

Remediate security findings on corporate systems. Close findings on corporate web properties and infrastructure, such as exposed staging sites, outdated components, abandoned hosting, and dangling DNS records, together with Marketing, Web, and Security.

Partner with Security on identity threat detection. Monitor sign-in and audit logs, tune risk policies, respond to identity-based incidents, and write KQL for dashboards and detections. Answer identity and device audit-log requests and own compliance reporting.

Set endpoint and SaaS standards. Own the architecture, configuration baselines, compliance policies, and security policy for Intune, Jamf, and Datto RMM, and the integration standards for Microsoft 365, Google Workspace, Slack, and Zoom. Day-to-day operation sits with the IT Administrator.

Administer Atlassian and workflow automation. Own administration of Jira, Jira Service Management, and Confluence, including the IT service workflow, and the Power Automate flows that support IT processes, with flow ownership, failure alerting, and runbooks.

Own AI tool administration and governance. Set usage policy, seat and quota approval criteria, and security review for AI tools such as Claude, Claude Code, and Cursor, including team and admin ownership, connectors, and MCP servers.

Deliver business-system integrations. Lead the IT side of integrations and enterprise app provisioning, such as Salesforce, the HR system, the compliance platform and Intune integration, telephony and sales tooling reviews, and apps that support Engineering and SOC repositories.

Broker cloud and engineering infrastructure access. Define how access to AWS, Azure, VPN, and engineering tools such as Cloudflare, log search, and deployment tooling is requested, approved, and granted, working with SRE and Security.

Oversee corporate network and office infrastructure vendors. Manage relationships and renewals for firewall, physical access control, network connectivity, and similar vendors, and keep the system inventory and renewal calendar current.

Be the Microsoft subject-matter expert. Serve as the deepest Microsoft resource in the company across Entra ID, Microsoft 365, Intune, Defender, and Azure fundamentals, and the authority on any Microsoft platform question.

Support Product and Engineering environments. Own the IT side of the Mac and Windows labs, the integration lab, VDI environments, test tenants, dogfooding setups, and engineering onboarding, including reproducing customer-style Microsoft 365 and Entra scenarios.

Support deployment of the Blackpoint agent through Datto RMM. Maintain the installer guides, scripts, and ComStore component used to deploy the Unified Agent, and provide technical escalation support on Datto RMM deployment issues raised through Technical Support.

Automate everything repeatable. Build and maintain automation using Microsoft Graph, PowerShell, Power Automate, and Python for provisioning, offboarding, license assignment, group governance, and reporting. Keep work in source control and make changes auditable.

Qualifications

• 7 to 10+ years in systems engineering, identity engineering, or senior IT infrastructure, with at least 4 years of deep, hands-on Microsoft Entra ID experience in a production tenant.

• Demonstrated expert-level skill with Conditional Access, PIM, authentication methods, app registrations and enterprise apps, and SAML/OIDC federation.

• Hands-on experience with Entra ID P2 capabilities: Identity Protection, access reviews, and entitlement management.

• Strong automation skills with Microsoft Graph API and PowerShell; Python or Bash a plus.

• Working knowledge of KQL and sign-in and audit log analysis; familiarity with identity threat detection concepts.

• Broad Microsoft platform expertise beyond identity: Microsoft 365 administration, Defender, and Azure fundamentals.

• Working experience implementing and evidencing technical controls for a compliance framework such as CMMC Level 2, NIST 800-171 or 800-53, SOC 2, or ISO 27001.

• Experience administering Jira, Jira Service Management, and Confluence, and building workflows with Power Automate or similar tools.

• Experience managing Intune at fleet scale; Jamf and macOS management strongly preferred; Datto RMM or another RMM platform a plus.

• Experience integrating SSO and identity providers beyond Entra (Auth0 strongly preferred), and with SCIM-based provisioning.

• Proven track record of executing against a defined strategy: planning, project delivery, and driving cross-functional work to completion.

• Established senior engineer with a strong, verifiable record of hands-on delivery. Formal people-management experience is not required; informal leadership such as mentoring, leading projects, or serving as the go-to escalation point is.

• Clear motivation to grow into management while staying close to the technical work.

• Clear written communicator who documents decisions and designs well.

Nice to Have

• Microsoft SC-300 (Identity and Access Administrator), MS-102, AZ-500, or SC-200 certification; at least one strongly preferred.

• Experience in a security vendor or MSP, or in a CMMC, FedRAMP, or federal-contracting environment.

• Infrastructure-as-code or configuration-as-code experience for Entra and Intune (for example Microsoft365DSC or Terraform).

Who Thrives in This Role

• A senior engineer who treats identity as a security discipline, not just an admin task.

• An operator who turns a set strategy into delivered, measurable results.

• An established engineer who wants to build management experience without leaving the keyboard.

• Someone who builds repeatable, auditable systems instead of one-off fixes.

• A strong independent problem-solver who can also unblock and develop others.

• Comfortable in a remote, high-ownership, fast-growing environment.

Blackpoint Cyber welcomes and encourages applications from qualified individuals of all races, colors, religions, sex, sexual orientation, gender identity or expression, national origin, age, marital status, or any other legally protected status. We are committed to equality of opportunity in all aspects of employment.

For eligible employees in the US, Blackpoint offers competitive Health, Vision, Dental, and Life Insurance plans, a robust 401k plan, Discretionary Time Off, and other minor perks. International employees receive competitive benefits in accordance with local market standards and applicable country requirements.

Blackpoint believes all employees should share in the company’s success – equity participation is available to employees globally, with program details varying by location and employment structure.