Job description

Summary: The Enterprise Systems and Employee Technology (ESET) team makes sure Cosm's employees have the tools they need to work quickly and efficiently: computers, SaaS services, and software. This team owns zero-touch provisioning, MDM, and device deployments across the organization, administers Cosm's portfolio of 100+ SaaS applications, maintains and optimizes the employee onboarding/offboarding lifecycle, and keeps Cosm's growing Okta deployment running smoothly. This role reports to the Director of Enterprise Systems and Employee Technology. Responsibilities: Own Cosm's Okta deployment: configuration, integrations, Workflows, and the identity roadmap as the environment scales. Design and maintain automated joiner–mover–leaver processes across the full employee lifecycle, in partnership with People Operations. Build and continuously improve zero-touch provisioning and device deployment across all Cosm locations and platforms. Administer Cosm's portfolio of 100+ SaaS applications: tenant configuration, SSO and SCIM integrations, entitlement models, and lifecycle management. Administer and optimize Apple Business Manager, Microsoft Intune, and Jamf, keeping the endpoint fleet current, compliant, and consistently configured. Run recurring account and access reviews, and produce evidence supporting [NIST CSF 2.0 / SOX ITGC] audit requirements. Automate routine administration through scripting and vendor APIs, reducing manual toil across the team. Partner with Service Management on hardware inventory and asset lifecycle across all locations. Act as the escalation point for identity, SaaS, and endpoint issues escalated by the Service Desk — resolving root causes and reducing recurrence through automation, configuration, and knowledge transfer. Create and maintain technical documentation and runbooks, and raise what the Service Desk can resolve independently through training and self-service enablement. Mentor teammates on identity and endpoint management practices, and act as a technical resource across the IT organization. Qualifications: 6+ years in corporate IT, with demonstrated depth in identity and endpoint management. Equivalent practical experience is welcome in place of a degree. Hands-on Okta administration experience, including Workflows for non-trivial automation use cases. 3+ years implementing and managing modern identity standards — SAML, OIDC, OAuth 2.0, SSO, MFA, and SCIM provisioning. Experience with an Identity Governance & Administration platform and with entitlement and access review design (Okta IGA, Sailpoint, etc) 3+ years managing macOS and Windows at scale with modern MDM (Intune, JAMF, Kandji/Iru, etc). Demonstrated experience building or maintaining zero-touch provisioning in a production environment. Working knowledge of Active Directory and Entra ID. Comfortable scripting to automate routine work (PowerShell, Bash, or Python) and integrating systems via vendor APIs. Solid grounding in core IT fundamentals — DNS, DHCP, TCP/IP, SMB, NFS, and certificate management. Strong communicator and self-starter with a methodical approach to troubleshooting and the ability to prioritize a varied workload independently or as part of a team. Preferred Skills: Okta Certified Administrator (Level 2) or Okta Certified Professional. Experience managing Okta configuration as code through Terraform, Pulumi, or a similar platform HIGHLY preferred Jamf 200 certification. Experience with Zero Trust, SASE, or DLP solutions (Zscaler, Cloudflare, or similar). Experience with additional device management platforms (Kandji, Autopilot). Familiarity with modern ITSM platforms (ServiceNow preferred). Experience supporting SaaS license management, renewals, and utilization reporting. The annualized salary range for this position in California is $130,000 to $145,000. The base pay offered will factor in internal equity and may also vary depending on the candidate's geographic region, job-related knowledge, skills, and relevant experience, among other factors

Requirements

Must-haves

Own Cosm's Okta deployment: configuration, integrations, Workflows, and the identity roadmap as the environment scales.
Design and maintain automated joiner–mover–leaver processes across the full employee lifecycle, in partnership with People Operations.
Build and continuously improve zero-touch provisioning and device deployment across all Cosm locations and platforms.
Administer Cosm's portfolio of 100+ SaaS applications: tenant configuration, SSO and SCIM integrations, entitlement models, and lifecycle management.
Administer and optimize Apple Business Manager, Microsoft Intune, and Jamf, keeping the endpoint fleet current, compliant, and consistently configured.
Run recurring account and access reviews, and produce evidence supporting [NIST CSF 2.0 / SOX ITGC] audit requirements.
Automate routine administration through scripting and vendor APIs, reducing manual toil across the team.
Partner with Service Management on hardware inventory and asset lifecycle across all locations.
Act as the escalation point for identity, SaaS, and endpoint issues escalated by the Service Desk — resolving root causes and reducing recurrence through automation, configuration, and knowledge transfer.
Create and maintain technical documentation and runbooks, and raise what the Service Desk can resolve independently through training and self-service enablement.
Mentor teammates on identity and endpoint management practices, and act as a technical resource across the IT organization.
6+ years in corporate IT, with demonstrated depth in identity and endpoint management. Equivalent practical experience is welcome in place of a degree.
Hands-on Okta administration experience, including Workflows for non-trivial automation use cases.
3+ years implementing and managing modern identity standards — SAML, OIDC, OAuth 2.0, SSO, MFA, and SCIM provisioning.
Experience with an Identity Governance & Administration platform and with entitlement and access review design (Okta IGA, Sailpoint, etc)
3+ years managing macOS and Windows at scale with modern MDM (Intune, JAMF, Kandji/Iru, etc).
Demonstrated experience building or maintaining zero-touch provisioning in a production environment.

Nice-to-haves

Okta Certified Administrator (Level 2) or Okta Certified Professional.
Experience managing Okta configuration as code through Terraform, Pulumi, or a similar platform HIGHLY preferred
Jamf 200 certification.
Experience with Zero Trust, SASE, or DLP solutions (Zscaler, Cloudflare, or similar).
Experience with additional device management platforms (Kandji, Autopilot).
Familiarity with modern ITSM platforms (ServiceNow preferred).
Experience supporting SaaS license management, renewals, and utilization reporting.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

python

Platform: dayforce
Effort: medium

Benefits

Benefits detected in the listing.

Vision