SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 145,000 - 158,000 / annual
Thatch is a fully distributed early-stage healthtech company transforming how America delivers healthcare. As IT Systems Engineer, you will own the systems and access infrastructure that keeps the company running securely and without friction.
You will take ownership of company-wide compliance, conditional access, and privileged access workflows in a Mac-first environment. This role goes beyond day-to-day support—you'll have the autonomy to build systems and automation that enable secure scaling.
Key responsibilities include:
- Own the technology stack: Okta, Iru, Mac, iOS, Android, Rippling MDM/SSO, 1Password, Google Workspace, Microsoft Office, Slack, Zoom, Linear, and Notion
- Drive endpoint fleet compliance to 100% coverage across MDM, EDR, and DLP; own remediation when devices fall out of compliance
- Administer conditional access policies (device trust, managed browser enforcement) and manage the exception/escalation process
- Own the Privileged Access Management (PAM) workflow, replacing manual quarterly reviews with automated request, approval, and time-bound removal
- Run trusted device and MFA enrollment; lead remediation campaigns for weak or breached passwords
- Manage the complete employee lifecycle from onboarding through offboarding, including access control, hardware provisioning, and audit-ready documentation
- Vet and administer new SaaS tooling for SSO/IdP compliance; expose and remediate shadow IT
- Build and maintain a knowledge base empowering employees to solve common issues independently
- Identify and build automation for repetitive IT and access-management tasks
- Partner with Head of IT and Security to support company-wide initiatives and maintain security posture
Requirements:
- 4–6 years of hands-on IT support or systems engineering experience in a corporate environment, ideally including some ownership of identity/access infrastructure
- Certification in Network+, Security+, JAMF, Bettercloud, Okta, or comparable credentials
- Deep understanding of SSO, 2FA, passkeys, conditional access, and password management systems
- Experience administering or implementing a PAM tool, or clear grasp of concepts and willingness to build one from scratch
- Strong knowledge of security principles and best practices with proven ability to implement them at scale
- Excellent follow-through and organizational skills
Desirable experience:
- Driving a fleet from partial to full MDM/EDR/DLP compliance and building exception workflows
- Self-motivated, independent work style with project ownership
- Quick learner who masters new technologies with minimal guidance
- Patient communicator with flexible, inclusive interpersonal skills
- Problem-solver resilient in learning from mistakes
- Thrives in fast-paced environments with changing priorities
