Celara
System Engineer – Security Administration & Endpoint Management (QB - SE - 20260507)
Remote available12 days ago
SeniorFull TimeContractEN
The Company builds enterprise software that powers restaurant chains at scale. Our systems span cloud infrastructure, distributed platforms, on-premise components, and a growing product ecosystem.
Security here is not abstract. It lives in the tools people use every day — their laptops, their access, their accounts. When something breaks, someone needs to own it. When someone joins or leaves, there needs to be a clean process. When an alert fires, someone needs to respond. That someone is this role!
You are the operational layer of security.
This is not a pure IT helpdesk role, and it's not a pure security engineering role. It sits exactly at the intersection — someone who can configure CrowdStrike and also help a new employee get set up, who understands why access controls matter and can actually enforce them, who responds to endpoint alerts and also makes sure offboarding doesn't leave loose ends.
Our corporate environment runs on low-touch/zero-touch trusted Mac/Windows devices, enterprise systems, and numerous hosted technologies. We have security tools deployed. What we don't have is consistent, end-to-end operational ownership of this layer.
That's what this role builds.
Endpoint Security — Day-to-Day and Long-Term
Own the full lifecycle of endpoint protection across our workforce: CrowdStrike deployment and policy management, disk encryption, patch compliance, workstation configuration baselines, USB/device controls, and browser security. Not just tool deployment — actual enforcement, drift detection, and keeping posture current as the environment changes.
Access and Identity Operations
Own the operational side of access: provisioning when people join, revocation when they leave, and nothing falling through the cracks in between. Work closely with the Infrastructure & Automation engineer on tooling — but the day-to-day execution and accountability sits here. Access review cycles, Okta configuration hygiene, and admin account controls are part of this surface.
Security Helpdesk and Incident First Response
Be the first line for security-related requests and IT issues — employee requests, alert triage, investigation support, and escalation when needed. This isn't ticket-pushing. It means knowing when something is noise and when it needs to go further.
Endpoint Lifecycle
Own procurement, ordering destruction, and re-provisioning of endpoints.Our infrastructure relies on low-touch/no-touch setup and device trust for authentication Your responsibility is to make sure we source and maintain hardware that meets this mission.
Onboarding and Offboarding
Own the security side of the employee lifecycle end-to-end: provisioning, configuration, deprovisioning, and verification. This needs to be reliable and repeatable, not improvised each time.
Policy and Configuration Compliance
Ensure endpoint and access controls remain aligned to corporate security policies and compliance requirements (SOC 2, PCI). Own the evidence that these controls are in place and working .
Software License Compliance & Records — Maintain accurate inventory of software licenses, ensure compliance with vendor agreements, track renewals and usage against entitlements.
AI Tools Governance — Maintain visibility into AI tools in use across the company. Assess data handling practices, ensure tools meet acceptable use standards, and flag risk to security leadership. This is not a blocker function — it's a visibility and hygiene function.
In 90 days, endpoint coverage is mapped, gaps are identified, and onboarding/offboarding has a defined, consistent process.
In 6 months, access controls are clean, patch compliance is tracked, and the security helpdesk function is running without things falling through.
In a year's time, this layer of the company’s security posture will be reliable, documented, and no longer a source of surprises.
