Administrator, Systems

We Do Consulting Differently Second Sight Solutions, a subsidiary of Berkeley Research Group (BRG), is a health technology company, and our innovative technology reimagines how drug discount data is exchanged, establishing new connections and improving transparency for drug manufacturers and their customers. Our customers and partners trust us to deliver reliable, first-to-market solutions and safeguard the data we receive. We trust our employees, and our culture gives them the freedom to create, collaborate, and grow. Our leaders are industry experts, creative, unafraid to challenge the status quo, and the pioneers of market-changing solutions. The Systems Administrator (IAM Engineer) position is a critical role within the Second Sight IT organization and an invaluable resource for Second Sight professionals.  This position owns the lifecycle, security, and governance of user identities and access across Second Sight’s Microsoft Entra ID–centered environment, ensuring that the right people have the right access to the right systems at the right time.  The right candidate is a highly motivated problem solver who pairs deep identity and access management (IAM) expertise with above average white glove customer service, and who will work closely with the Security Team and the IT Services team to support our customer base (aka Second Sight) in a Mac and Cloud Service supported environment. Key Responsibilities: Identity Lifecycle Management Own the end-to-end joiner, mover, and leaver process for employees and contractors in Microsoft Entra ID, including account provisioning, role and group changes, and timely revocation of access at offboarding. Administer Microsoft Entra ID users, security, and Microsoft 365 groups (including dynamic groups), guest (B2B) accounts, and device registrations, as well as maintain standards for naming, attributes, and group-based licensing. Manage user access across the software systems used within Second Sight, including onboarding applications to single sign-on (SAML/OIDC), configuring enterprise applications and app registrations, and automated user provisioning (SCIM) where supported. Coordinate with Governance, Risk and Compliance (GRC), HR, department managers, and application owners to define role-based access models and approve, fulfill, and document access requests. Authentication and Access Control Design, implement, and maintain Conditional Access policies, including device compliance, location, and risk-based controls, using documented testing and change management. Manage multi-factor and passwordless authentication (e.g., Microsoft Authenticator, FIDO2 security keys, passkeys, Temporary Access Pass), self-service password reset, and authentication method policies. Administer privileged access using least-privilege, role-based access control, including Privileged Identity Management (PIM) just-in-time elevation, separate administrative accounts, and emergency (break-glass) account procedures. Monitor sign-in and audit logs and identity risk signals (e.g., risky sign-ins and users) and, with the Security Operations Team, investigate and remediate suspicious activity and identity-related security findings. Access Governance, Audit, and Compliance Plan and perform periodic access reviews and recertifications for users, groups, applications, and privileged roles; follow up on remediation and retain evidence for auditors. Perform regular audits to ensure compliance with IT and access policies, identify excessive or orphaned access and stale accounts, and identify potential security risks. Support internal and external audits and client security assessments by providing identity and access evidence, documentation, and reporting. Develop and maintain IAM standards, procedures, runbooks, and metrics; develop and deliver employee training on secure authentication and access practices. Automation and Integration Automate identity lifecycle, reporting, and routine administration tasks using PowerShell, Microsoft Graph, Entra lifecycle workflows, and similar tools. Integrate Entra ID with HR sources, Help Desk, and ticketing software (e.g., Jira), endpoint management (Jamf, Intune), and SaaS applications to streamline access requests and approvals. Research and evaluate new identity, authentication, and access governance capabilities and recommend improvements. Endpoint and Systems Support Manage endpoints (MacBooks) that are returned to the DC office as part of the off-boarding process.  This will include inventorying and preparing for shipment to other endpoint specialists. Assist with the onboarding and offboarding process for MacOS users, including setting up new devices and revoking access when necessary. Provide Tier 2/3 support for identity and access incidents, such as account lockouts, MFA enrollment and recovery, and application access issues. Support Mac devices in coordination with identity controls, including device compliance, FileVault, and Jamf/Intune integration with Entra ID Conditional Access and single sign-on for macOS users. The following items are as time is available: Deploy, maintain, and troubleshoot MacBooks and mobile devices (iOS, tablets, and smartphones), both remotely and onsite; manage standardized workstation software configurations and updates and patches for MacOS and installed software with minimal disruption to end users. Troubleshoot general MacOS issues and interactions with Microsoft 365, centralized management software (e.g., Jamf, FileVault), and endpoint security software (e.g., Defender); help Second Sight team members with questions regarding commercial off the shelf (COTS) software applications (Office 365 tools, Adobe, Intune, etc.). Collaboration and Projects Work as part of a team, sharing duties with other IT personnel throughout Second Sight Solutions, and coordinate project actions with the IT Services Manager, System Administrators, vendo