IT Systems Engineer (Mid–Senior)

About Zynap and the role

Zynap is a cybersecurity company of around 40 people hiring its first dedicated IT Systems Engineer. You will own corporate IT end to end: identity and access, endpoints, SaaS and licences, the office network, and the joiner–mover–leaver process. Today this work is absorbed by the DevOps team between platform incidents, which means it gets done late or not at all.

There is no IT department to join. You are the one being hired to build it, with DevOps as your closest ally and the budget conversation going straight to the people who decide.

What you’ll own

You are the person everyone asks, and the person who makes sure they stop having to ask twice.

1. Identity and access: accounts, groups and permissions across Microsoft 365, Slack, GitLab, AWS SSO and the rest of the SaaS stack. You own the joiner–mover–leaver process: someone starts with the right access on day one and loses all of it on their last day, with a record either way
2. Endpoints: the laptop fleet through the MDM (enrolment, baseline configuration, disk encryption, patching), and knowing what the company owns and who has it
3. Helpdesk: first and second line for the whole company through #it-helpdesk. Not just closing tickets, but spotting the question that keeps coming back and removing the reason for it
4. SaaS and licences: the inventory, the renewals and the seats nobody uses. Roughly thirty tools, several on annual contracts
5. The office network: firewall, WAN links and failover, WiFi and the VPN. Documented, and you know when something breaks before a colleague tells you
6. Email and collaboration hygiene: Exchange Online, shared mailboxes, distribution groups, and the SPF/DKIM/DMARC posture of the sending domains
7. Corporate security hygiene: MFA coverage, password manager governance, phishing response, and the access reviews that prove any of it is true
8. Documentation: runbooks that let someone else do the job while you’re on holiday

Your first 90 days

We would rather tell you what success looks like than leave you guessing. None of these are stretch goals: they are the floor, and the reason the role exists.

1. Day 30: a single inventory that answers who has which laptop, which accounts and which licences, and when each contract renews. It does not exist today
2. Day 60: a joiner–mover–leaver runbook that has survived at least one real offboarding, with access revocation evidenced rather than assumed
3. Day 90: the office network documented and monitored, so a dead link or a failed device raises an alert instead of being discovered by someone who cannot work

The stack you’ll work with (what we actually run, not a wish list)

1. Identity and email: Microsoft 365, Entra ID, Exchange Online
2. Collaboration: Slack, Atlassian (Jira, Confluence), SharePoint
3. Endpoints: Rippling MDM
4. Credentials: NordPass, GitLab tokens and deploy credentials
5. Office network: pfSense firewall, dual WAN, Grandstream GWN access points via GDMS
6. Remote access: WireGuard mesh, OpenVPN
7. Cloud identity: AWS across seven accounts, IAM Identity Center, GitLab. Human access and its review only

What is not yours: the product platform. Kubernetes, Terraform, the CI/CD pipelines and the production AWS estate belong to DevOps. You will work with that team constantly, since identity, networking and secrets are shared ground, but you are not on call for the product.

You will not know all of this on day one. Nobody does. We care that you are the kind of person who finds out rather than guesses.

What we’re looking for

Four to eight years doing this work, in a company small enough that you were the one who fixed it.

Must have

1. Hands-on administration of Microsoft 365 and an identity provider, including groups, conditional access and mail flow. Not just the admin console, but why a rule exists
2. Endpoint management at fleet scale through an MDM, with a defensible security baseline
3. Practical networking: VLANs, firewall rules, DNS, DHCP and VPN. Enough to read a packet capture when the answer is not in a dashboard
4. Scripting to make the boring parts disappear. PowerShell, Python or bash: we care that you automate, not which language you use
5. Experience running onboarding and offboarding as a process with evidence, not as a checklist in someone’s head
6. Working English, written and spoken. The company works in Spanish and English, and the documentation is in English

Bonus, genuinely not a filter

1. Exposure to AWS IAM and multi-account access
2. A security certification, or the scar tissue that would have earned you one
3. Having been audited (ISO 27001, SOC 2 or similar) and knowing what evidence an auditor actually accepts
4. Familiarity with pfSense, WireGuard or Grandstream hardware
5. Any experience at a cybersecurity company, where colleagues will notice if the internal posture is worse than the product

How we work, and who this is not for

You will probably enjoy this if you like inheriting something unfinished and leaving it documented, if you would rather fix the cause than close the ticket faster, and if you are comfortable saying “I don’t know yet, give me until tomorrow”.

You will probably hate this if you want a defined queue handed to you each morning, a change advisory board to hide behind, or a team of three to delegate to. None of that exists here, and pretending otherwise would waste your year and ours.

One more thing. We are a cybersecurity company, so our colleagues are a demanding internal audience. They will notice a weak password policy and they will tell you. We think that is a feature: the argument for doing this properly is already won before you arrive.

Must-have skills: Entra ID, mdm, M365, Networking, IAM (Identity Access Management), Cyber Security.

Nice-to-have skills: VPN, Scripting, Python, Powershell, Microsoft Exchange, DNS, DHCP.

Required languages: english (level 4/5), spanish (level 4/5).

Open only to candidates already eligible to work in the EU.