Principal, Enclave Systems & Support Administrator

This is a remote position for candidates located in or near the Washington, DC metropolitan area, including Washington, DC and West Virginia.

U.S. citizenship is required for this role .

Your role:

The Enclave Systems & Support Administrator designs, builds, hardens, and operates the technical enclave — configuring identity, endpoints, data-protection controls, and FIPS-validated cryptography, and running change management — while also delivering tier-1 through tier-3 support: provisioning endpoints, issuing and tracking FIDO2 security keys, resetting credentials under least-privilege scope, and onboarding/training end users through migration and steady-state operations.

Architecture, Build & Change Management

• Administer Google Workspace Enterprise Plus: Cloud Identity, OU design, custom admin roles, DLP, Drive labels/IRM, trust rules, and mail compliance.
• Build and operate ChromeOS / Chrome Enterprise endpoints and Amazon WorkSpaces (AWS GovCloud) Windows VDI.
• Configure SAML SSO with FIDO2 phishing-resistant authentication and Context-Aware Access policies.
• Establish and maintain hardened configuration baselines; enforce FIPS-mode cryptography across data states.
• Run change management: document, test, and approve configuration changes against the baseline and SSP.
• Develop scripting / automation for provisioning, configuration, and reporting; maintain backup and restore.
• Produce configuration evidence for control assessments and the C3PAO / KPMG reviews.

Front-Line Support & Access Hygiene

• Provide tier-1 through tier-3 service desk support, including the password / MFA reset function (least privilege, fully logged).
• Provision and manage endpoints and MDM for Chromebook / Chrome Enterprise devices.
• Issue, inventory, and track FIDO2 security keys (two per user) and manage lifecycle / replacement.
• Lead user onboarding, joiner-mover-leaver actions, and migration of users and data into the enclave.
• Deliver end-user security awareness and CUI-handling training sessions.
• Maintain security hygiene: patch verification, asset tracking, and ticket documentation.
• Escalate significant security events to the ISSO & Security Operations Lead per the incident-response runbooks.

What you bring to the role:

• 7+ years of experience with 5+ years administering Google Workspace Enterprise Plus (or equivalent) at scale, including direct end-user / service-desk support experience.
• Bachelor's degree or higher in cyber security, computer science/engineering, management of information systems or similar degrees.
• Hands-on experience with AWS (GovCloud preferred), Amazon WorkSpaces / VDI, and Chrome Enterprise — both administration and provisioning/support.
• Strong identity background: SAML SSO, FIDO2/WebAuthn, conditional/context-aware access, and MFA / hardware-key lifecycle management.
• Configuration-baseline, hardening, and change-management discipline; scripting/automation skills.
• Backup/restore and operational resilience experience.
• Strong customer-service skills and disciplined ticket / asset documentation practice.

Preferred Certifications and Qualifications

• Google Workspace Administrator certification.
• AWS SysOps Administrator or AWS Security Specialty (helpful).
• CompTIA Security+ and/or CompTIA A+.

Citizenship, Screening and Trust

• U.S. citizenship is required (CUI access and Security Protection function).
• Must pass Ingram Micro background screening and complete CUI handling, insider-threat, and incident-handling training before access.
• Subject to least-privilege access controls and periodic access recertification; the dual compliance-owner / operator scope of this role is independently validated via the third-party KPMG / C3PAO assessment.

Work Model & Conditions

Full-time exempt role based in the U.S.. Occasional travel for the C3PAO assessment and audit activities. Standard business hours with a scheduled on-call rotation for after-hours Sev1/2 incident escalation; extended hours possible during active incidents or the C3PAO assessment window.

#LI-SK1

#LI-Remote