IT Systems & Security Operations Specialist

About the Role

We are a U.S.-based strategic communications and marketing agency serving clients in public health, government, education, and social impact sectors. Our work involves complex projects, multiple systems, and strict data security requirements.

We are seeking an IT Systems & Security Operations Specialist to own and manage the company’s technology environment, including systems, apps, equipment, and websites, and to lead day-to-day security operations. This role administers company systems, monitors for and responds to cybersecurity threats, protects sensitive client and company data, supports staff with technical issues, and keeps our tools and infrastructure running smoothly.

This is not a basic help desk role. We are looking for someone who can think strategically about systems, security, and operational efficiency, and who can detect, investigate, and contain threats before they affect our clients. This role also includes data entry and support with data collection for active client projects as needed.

Key Responsibilities

Systems Administration

Manage accounts, access, and configurations across company systems, including:

• Google Workspace / Google Admin
• Microsoft 365 & Microsoft Teams
• Apple
• Asana
• Slack
• Zoom
• Adobe
• Gusto
• Stripe
• Squarespace
• GoDaddy
• Mailchimp
• Whova
• IBM SPSS
• Google Drive and cloud storage systems
• Additional tools used by the agency

Responsibilities include:

• Creating and managing user accounts
• Access permissions and role management
• System configuration and maintenance, including secure baseline settings for each platform
• Monitoring system updates and new features

Identity & Access Management

• Implement and maintain secure authentication protocols
• Enforce multi-factor authentication (MFA) across all systems, prioritizing phishing resistant methods for administrator accounts
• Manage role-based access permissions using least-privilege principles
• Manage and monitor privileged and administrator accounts
• Conduct periodic access audits and remove unused or excess access promptly
• Maintain Single Sign-On (SSO) where applicable
• Enforce company password management policies and tools

Security Operations & Threat Detection (SOC)

• Serve as the company’s primary security operations function, monitoring for and responding to threats across cloud, email, identity, endpoint, and web environments
• Monitor and triage security alerts from Google Workspace, Microsoft 365 / Defender, endpoint protection (EDR/XDR), and other security tools
• Analyze logs and activity for indicators of compromise, including suspicious logins, impossible travel, unusual data downloads or sharing, mailbox rule changes, and unauthorized OAuth app grants
• Configure, tune, and maintain detection rules and alerting to improve accuracy and reduce false positives
• Conduct proactive threat hunting based on current threat intelligence relevant to our sector and technology stack
• Investigate suspected phishing, business email compromise, malware, and account takeover attempts
• Maintain email security controls, including spam and phishing filtering and SPF, DKIM, and DMARC records
• Monitor threat intelligence sources and vendor advisories for vulnerabilities and threats affecting our systems
• Escalate confirmed or high-severity threats to leadership with clear, timely summaries If the company engages a managed detection and response (MDR) or managed SOC provider, serve as the internal owner of that relationship, including escalations, tuning, and service reviews Incident Response
• Develop, maintain, and test the company’s incident response plan and playbooks (e.g., phishing, account compromise, ransomware, lost or stolen device, data exposure)
• Lead containment, eradication, and recovery during security incidents
• Preserve logs and evidence to support investigation and any required reporting
• Document incidents, timelines, root causes, and corrective actions
• Provide leadership with the facts needed for client, contractual, legal, or regulatory notification decisions
• Facilitate periodic tabletop exercises with relevant staff

Vulnerability & Patch Management

• Maintain an inventory of systems, devices, and applications to define the company’s security footprint
• Run regular vulnerability scans and review SaaS security configurations for misconfigurations
• Track, prioritize, and verify remediation of vulnerabilities based on risk
• Ensure operating systems, applications, browsers, and website components are patched on schedule
• Monitor endpoint compliance, including encryption, screen lock, OS version, and security software status

Data Protection & Privacy

• Develop and maintain a data classification framework (e.g., public, internal, confidential, restricted client data)
• Implement and manage data loss prevention (DLP) controls in Google Workspace and Microsoft 365
• Monitor and restrict external file sharing, public links, and access to sensitive folders
• Ensure encryption of data in transit and at rest, including full-disk encryption on company devices
• Maintain data retention and secure deletion practices aligned with client contracts and company policy
• Support compliance with client data security requirements, including security questionnaires, contract terms, and data handling agreements
• Assess the security and privacy practices of new tools and vendors before adoption
• Maintain data protection standards for sensitive client and company information, including personally identifiable information and research data

Security Awareness

• Deliver security awareness training during onboarding and on a recurring basis
• Run periodic phishing simulations and provide targeted follow-up training
• Serve as the go-to resource for staff questions about suspicious emails, messages, or activity Security Reporting
• Provide leadership with regular security reports covering alerts, incidents, vulnerabilities, access reviews, and training completion
• Recommend security improvements and investments based on risk, aligned with a recognized framework such as the NIST Cybersecurity Framework or CIS Controls

Backup & Disaster Recovery

• Maintain data backup protocols, including protection against ransomware and accidental deletion
• Ensure company data is backed up and recoverable
• Periodically test restoration procedures
• Maintain documentation of disaster recovery plans

Equipment & Device Management

• Maintain inventory of all company and technology equipment
• Manage devices through mobile device management (MDM) tools, including remote lock and wipe
• Register and track device updates and warranties
• Order equipment as needed for new employees
• Manage onboarding and offboarding technology setup, including same-day access removal at offboarding
• Support remote employees with device troubleshooting

Technical Support

• Provide troubleshooting support for employees experiencing technical issues
• Assist staff with system setup and best practices
• Maintain documentation and guides for internal systems

Vendor & License Management

• Track software licenses and seat utilization
• Manage renewals and vendor relationships
• Monitor software costs and identify opportunities to reduce expenses
• Negotiate pricing when appropriate

Workflow Optimization & Automation

• Identify opportunities to improve workflows across systems
• Recommend and implement integrations or automation tools where appropriate, including security alert and access workflows
• Maintain efficient system architecture as the company grows

Data & Research Support

Support internal research and analytics projects by:

• Assisting with survey administration and online data collection
• Organizing incoming data and ensuring it is stored and shared securely
• Performing data entry and data cleaning when needed
• Supporting research teams with tools such as SPSS or survey platforms

File & Digital Systems Organization

• Maintain a clear and structured company file system
• Ensure files are organized, accessible, and properly labeled
• Manage access permissions across shared drives
• Periodically review and improve file structures

Documentation & Training

• Maintain documentation of all company systems, security policies, and workflows
• Stay informed about new tools, threats, and best practices
• Conduct occasional internal trainings to help staff use systems effectively and securely

Website Management (Squarespace)

• Maintain and update the company website using the Squarespace CMS
• Publish new content including pages, blog posts, team updates, and announcements
• Implement basic site configuration and layout adjustments as needed
• Ensure website functionality, forms, and integrations remain operational
• Coordinate updates to images, copy, and page structure based on internal requests
• Monitor site performance and identify opportunities for improvement
• Maintain organized backups of website content and assets
• Secure website and domain accounts (Squarespace, GoDaddy) with MFA, domain lock, and DNS monitoring
• Perform routine maintenance and updates to ensure the website remains secure and up to date

Required Qualifications

• Bachelor’s degree in Information Systems, Computer Science, IT, Cybersecurity, or a related field
• 5+ years of experience managing SaaS systems and cloud tools, including at least 2 years in security operations, SOC, or incident response
• Strong experience with Google Workspace administration and its security controls
• Hands-on experience with Microsoft 365 security tools (e.g., Microsoft Defender, Entra ID)
• Hands-on experience with SIEM, EDR/XDR, or similar security monitoring tools
• Experience triaging alerts, analyzing logs, and investigating phishing and account compromise
• Experience managing multiple SaaS platforms in a business environment
• Experience with user access management, permissions, and MFA enforcement
• Working knowledge of data protection practices, including DLP, encryption, and secure file sharing
• Strong understanding of cybersecurity best practices and frameworks such as the

NIST Cybersecurity Framework or CIS Controls

• Excellent troubleshooting and problem-solving skills
• Strong written and spoken English communication, including the ability to explain security issues to non-technical staff and leadership
• Experience supporting remote teams Preferred (Nice to Have)
• Security certifications such as CompTIA Security+, CompTIA CySA+, Microsoft SC- 200, GIAC (GSEC, GCIH), or equivalent
• Experience handling sensitive data subject to U.S. requirements such as HIPAA, FERPA, CCPA/CPRA, or government contract security terms
• Experience working with a managed detection and response (MDR) or managed SOC provider
• Experience with Mac and Windows device management (MDM) tools
• Experience developing incident response plans and running tabletop exercises
• Experience managing systems for a service-based business or agency
• Experience with Asana administration
• Experience with data management or research tools (SPSS, surveys, analytics)
• Experience implementing automation or integrations
• Experience managing distributed or international teams

Work Structure

• Remote (Philippines-based)
• Full-time, long-term role
• U.S. Pacific Time
• Availability for after-hours escalation during critical security incidents, under an agreed on-call arrangement
• Stable internet connection and a secure, private workspace required

Pay: Php60,000.00 - Php80,000.00 per month

Application Question(s):

• Do you have at least 2 years of hands-on experience in security operations, SOC, or incident response?
• Do you have hands-on experience administering Google Workspace, including its security controls (e.g., MFA, DLP, and external sharing settings)?
• Have you used Microsoft 365 security tools such as Microsoft Defender or Entra ID in a work setting?
• Have you triaged security alerts and investigated phishing or account compromise incidents using a SIEM, EDR/XDR, or similar monitoring tool?
• Have you led containment and recovery during a security incident, or developed an incident response plan or playbooks?
• Have you implemented data protection controls such as DLP, encryption, or restrictions on external file sharing to protect sensitive data?
• Are you able to work U.S. Pacific Time hours and be available for after-hours escalation during critical security incidents under an agreed on-call arrangement?
• Do you have a stable internet connection and a secure, private workspace for remote work?

Work Location: Remote