Cloud Systems Administrator

Headquarters:
URL: https://oneimaging.com

The Systems Administrator owns the day-to-day administration of our SaaS and cloud vendor stack, with security and logging as the first priority. You will manage user access across every platform we use, keep audit logging and security controls configured and reviewed, write scripts to automate repetitive admin work, and act as a first responder on security incidents. You will also provide hands-on IT support to employees. This is a generalist role for someone who likes owning systems end to end: you are the person who knows how each vendor is set up, who has access to what, and where the logs live.

What you'll do:

Vendor and SaaS administration (security and logging first)

• Serve as the primary administrator for our SaaS and cloud platforms: tenant settings, SSO/SAML and SCIM integration, MFA enforcement, API keys, roles and permissions.
• Configure and maintain audit logging on every platform that supports it; centralize logs where possible and make sure retention meets our compliance needs.
• Run periodic access reviews, remove stale accounts and over-privileged roles, and keep an accurate inventory of who has admin rights where.
• Own the security posture of each vendor: review security settings on new tools before rollout, track vendor security notices, and evaluate new vendor requests for risk.

User lifecycle and identity

• Onboard and offboard employees and contractors across all systems the same day, driven from Rippling and Google Workspace, our identity sources of truth.
• Manage groups, roles and licenses; keep license counts right-sized and flag waste.
• Maintain device enrollment, MDM policies and endpoint security for company laptops.

Scripting and automation

• Write and maintain scripts (Python, PowerShell, Bash) and use vendor APIs to automate provisioning, access reviews, log collection and reporting.
• Build lightweight integrations between systems (for example, HRIS to identity provider to SaaS) so manual admin work shrinks over time.

Security incident response

• Act as a first responder on security alerts: triage, contain (disable accounts, revoke tokens, isolate devices), gather evidence from logs, and escalate.
• Participate in post-incident reviews and implement the fixes that come out of them.
• Help maintain and test our incident response and business continuity runbooks.

IT support

• Provide tier 1–2 support to employees: hardware, accounts, access, video conferencing, printers and office network.
• Procure, image and manage laptops and peripherals; keep an asset inventory current.
• Write and keep up internal how-to documentation so common requests become self-service.

Platforms you will administer

These are our largest software and cloud vendors by spend over the last 12 months. Deep experience with the first group is expected; the rest you will pick up on the job.

Area

Platforms

Cloud infrastructure

Amazon Web Services (IAM, CloudTrail, GuardDuty, Security Hub)

Identity, HR and devices

Rippling (HRIS, SSO, device management) and Google Workspace, used together as our identity source of truth

Productivity and email

Google Workspace (admin console, Vault, security center)

Customer support and CRM

Zendesk, Salesforce, Intercom

Communications

Zoom, Aircall, Twilio

Data and engineering

Databricks, MongoDB Atlas, Sentry, Linear, Postman, Stytch

AI platforms

Anthropic, OpenAI (API key and usage management)

Collaboration and design

Notion, Lucid, Figma, Adobe, Scribe

Security tools

NordVPN Teams, Virtru (email encryption)

Healthcare operations

Waystar, AdvancedMD

Marketing and recruiting

Braze, ActiveCampaign, Greenhouse, LinkedIn

About you:

• 3+ years administering SaaS and cloud platforms in a company of 50–500 people, including Google Workspace and an identity/HR platform like Rippling or Okta, and ideally AWS.
• Hands-on experience configuring SSO/SAML, SCIM provisioning, MFA policies and role-based access.
• Working knowledge of audit logging and log review: you know what a CloudTrail event, a Workspace audit log or a Zendesk audit entry looks like and what to do with it.
• Scripting ability in at least one of Python, PowerShell or Bash, and comfort calling REST APIs.
• Experience responding to security incidents (phishing, compromised accounts, lost devices) and documenting what happened.
• Strong IT support instincts: you communicate clearly with non-technical colleagues and close tickets fast.
• Familiarity with HIPAA or a comparable compliance framework (SOC 2, ISO 27001) and what it means for access control and logging.

Nice to have:

• AWS Certified SysOps Administrator, Security Specialty, or Google Workspace Administrator certification.
• Experience with a SIEM or log aggregation tool (Datadog, Splunk, Google SecOps, or similar) and writing detection rules.
• MDM experience (Rippling, Jamf, Kandji, Intune) and macOS/Windows endpoint hardening.
• Terraform or other infrastructure-as-code for managing AWS and SaaS configuration.
• Prior work in a healthcare or other regulated company.
• Experience administering API usage and keys for AI platforms (Anthropic, OpenAI) and setting spend and access controls.

The base salary range for this position is $60,000 - $75,000. Individual compensation will depend on various factors, including qualifications, skills, experience, location, and applicable laws. In addition to base salary, this role is eligible to participate in our equity incentive and competitive benefits plans.

To apply: https://weworkremotely.com/remote-jobs/oneimaging-cloud-systems-administrator