IT Systems & Security Operations Specialist

About the Role

We are a U.S.-based strategic communications and marketing agency serving clients in public health, government, education, and social impact sectors. Our work involves complex projects, multiple systems, and strict data security requirements.

We are seeking an IT Systems & Security Operations Specialist to own and manage the company’s technology environment, including systems, apps, equipment, and websites, and to lead day-to-day security operations. This role administers company systems, monitors for and responds to cybersecurity threats, protects sensitive client and company data, supports staff with technical issues, and keeps our tools and infrastructure running smoothly.

This is not a basic help desk role. We are looking for someone who can think strategically about systems, security, and operational efficiency, and who can detect, investigate, and contain threats before they affect our clients. This role also includes data entry and support with data collection for active client projects as needed.

Key Responsibilities

Systems Administration

Manage accounts, access, and configurations across company systems, including:

Google Workspace / Google Admin
Microsoft 365 & Microsoft Teams
Apple
Asana
Slack
Zoom
Adobe
Gusto
Stripe
Squarespace
GoDaddy
Mailchimp
Whova
IBM SPSS
Google Drive and cloud storage systems
Additional tools used by the agency
Responsibilities include:

Creating and managing user accounts
Access permissions and role management
System configuration and maintenance, including secure baseline settings for each platform
Monitoring system updates and new features
Identity & Access Management

Implement and maintain secure authentication protocols
Enforce multi-factor authentication (MFA) across all systems, prioritizing phishing resistant methods for administrator accounts
Manage role-based access permissions using least-privilege principles
Manage and monitor privileged and administrator accounts
Conduct periodic access audits and remove unused or excess access promptly
Maintain Single Sign-On (SSO) where applicable
Enforce company password management policies and tools
Security Operations & Threat Detection (SOC)

Serve as the company’s primary security operations function, monitoring for and responding to threats across cloud, email, identity, endpoint, and web environments
Monitor and triage security alerts from Google Workspace, Microsoft 365 / Defender, endpoint protection (EDR/XDR), and other security tools
Analyze logs and activity for indicators of compromise, including suspicious logins, impossible travel, unusual data downloads or sharing, mailbox rule changes, and unauthorized OAuth app grants
Configure, tune, and maintain detection rules and alerting to improve accuracy and reduce false positives
Conduct proactive threat hunting based on current threat intelligence relevant to our sector and technology stack
Investigate suspected phishing, business email compromise, malware, and account takeover attempts
Maintain email security controls, including spam and phishing filtering and SPF, DKIM, and DMARC records
Monitor threat intelligence sources and vendor advisories for vulnerabilities and threats affecting our systems
Escalate confirmed or high-severity threats to leadership with clear, timely summaries If the company engages a managed detection and response (MDR) or managed SOC provider, serve as the internal owner of that relationship, including escalations, tuning, and service reviews I ---------- Response
Develop, maintain, and test the company’s i ---------- response plan and playbooks (e.g., phishing, account compromise, ransomware, lost or stolen device, data exposure)
Lead containment, eradication, and recovery during security i ----------
Preserve logs and evidence to support investigation and any required reporting
Document i ---------- , timelines, root causes, and corrective actions
Provide leadership with the facts needed for client, contractual, legal, or regulatory notification decisions
Facilitate periodic tabletop exercises with relevant staff
Vulnerability & Patch Management

Maintain an inventory of systems, devices, and applications to define the company’s security footprint
Run regular vulnerability scans and review SaaS security configurations for misconfigurations
Track, prioritize, and verify remediation of vulnerabilities based on risk
Ensure operating systems, applications, browsers, and website components are patched on schedule
Monitor endpoint compliance, including encryption, screen lock, OS version, and security software status
Data Protection & Privacy

Develop and maintain a data classification framework (e.g., public, internal, confidential, restricted client data)
Implement and manage data loss prevention (DLP) controls in Google Workspace and Microsoft 365
Monitor and restrict external file sharing, public links, and access to sensitive folders
Ensure encryption of data in transit and at rest, including full-disk encryption on company devices
Maintain data retention and secure deletion practices aligned with client contracts and company policy
Support compliance with client data security requirements, including security questionnaires, contract terms, and data handling agreements
Assess the security and privacy practices of new tools and vendors before adoption
Maintain data protection standards for sensitive client and company information, including personally identifiable information and research data
Security Awareness

Deliver security awareness training during onboarding and on a recurring basis
Run periodic phishing simulations and provide targeted follow-up training
Serve as the go-to resource for staff questions about suspicious emails, messages, or activity Security Reporting
Provide leadership with regular security reports covering alerts, i ---------- , vulnerabilities, access reviews, and training completion
Recommend security improvements and investments based on risk, aligned with a recognized framework such as the NIST Cybersecurity Framework or CIS Controls
Backup & Disaster Recovery

Maintain data backup protocols, including protection against ransomware and a ---------- deletion
Ensure company data is backed up and recoverable
Periodically test restoration procedures
Maintain documentation of disaster recovery plans
Equipment & Device Management

Maintain inventory of all company and technology equipment
Manage devices through mobile device management (MDM) tools, including remote lock and wipe
Register and track device updates and warranties
Order equipment as needed for new employees
Manage onboarding and offboarding technology setup, including same-day access removal at offboarding
Support remote employees with device troubleshooting
Technical Support

Provide troubleshooting support for employees experiencing technical issues
Assist staff with system setup and best practices
Maintain documentation and guides for internal systems
Vendor & License Management

Track software licenses and seat utilization
Manage renewals and vendor relationships
Monitor software costs and identify opportunities to reduce expenses
Negotiate pricing when appropriate
Workflow Optimization & Automation

Identify opportunities to improve workflows across systems
Recommend and implement integrations or automation tools where appropriate, including security alert and access workflows
Maintain efficient system architecture as the company grows
Data & Research Support

Support internal research and analytics projects by:

Assisting with survey administration and online data collection
Organizing incoming data and ensuring it is stored and shared securely
Performing data entry and data cleaning when needed
Supporting research teams with tools such as SPSS or survey platforms
File & Digital Systems Organization

Maintain a clear and structured company file system
Ensure files are organized, accessible, and properly labeled
Manage access permissions across shared drives
Periodically review and improve file structures
Documentation & Training

Maintain documentation of all company systems, security policies, and workflows
Stay informed about new tools, threats, and best practices
Conduct occasional internal trainings to help staff use systems effectively and securely
Website Management (Squarespace)

Maintain and update the company website using the Squarespace CMS
Publish new content including pages, blog posts, team updates, and announcements
Implement basic site configuration and layout adjustments as needed
Ensure website functionality, forms, and integrations remain operational
Coordinate updates to images, copy, and page structure based on internal requests
Monitor site performance and identify opportunities for improvement
Maintain organized backups of website content and assets
Secure website and domain accounts (Squarespace, GoDaddy) with MFA, domain lock, and DNS monitoring
Perform routine maintenance and updates to ensure the website remains secure and up to date
Required Qualifications

Bachelor’s degree in Information Systems, Computer Science, IT, Cybersecurity, or a related field
5+ years of experience managing SaaS systems and cloud tools, including at least 2 years in security operations, SOC, or i ---------- response
Strong experience with Google Workspace administration and its security controls
Hands-on experience with Microsoft 365 security tools (e.g., Microsoft Defender, Entra ID)
Hands-on experience with SIEM, EDR/XDR, or similar security monitoring tools
Experience triaging alerts, analyzing logs, and investigating phishing and account compromise
Experience managing multiple SaaS platforms in a business environment
Experience with user access management, permissions, and MFA enforcement
Working knowledge of data protection practices, including DLP, encryption, and secure file sharing
Strong understanding of cybersecurity best practices and frameworks such as the
NIST Cybersecurity Framework or CIS Controls

Excellent troubleshooting and problem-solving skills
Strong written and spoken English communication, including the ability to explain security issues to non-technical staff and leadership
Experience supporting remote teams Preferred (Nice to Have)
Security certifications such as CompTIA Security+, CompTIA CySA+, Microsoft SC- 200, GIAC (GSEC, GCIH), or equivalent
Experience handling sensitive data subject to U.S. requirements such as HIPAA, FERPA, CCPA/CPRA, or government contract security terms
Experience working with a managed detection and response (MDR) or managed SOC provider
Experience with Mac and Windows device management (MDM) tools
Experience developing i ---------- response plans and running tabletop exercises
Experience managing systems for a service-based business or agency
Experience with Asana administration
Experience with data management or research tools (SPSS, surveys, analytics)
Experience implementing automation or integrations
Experience managing distributed or international teams

Work Structure

Remote (Philippines-based)
Full-time, long-term role
U.S. Pacific Time
Availability for after-hours escalation during critical security i ---------- , under an agreed on-call arrangement
Stable internet connection and a secure, private workspace required