IT Operations & Cybersecurity Manager

Job Description: IT Operations & Cybersecurity Manager Company: Rain Media Reports to: Chief of Staff to the CEO / EVP of Business Operations Status: Full-time / W2 Location: US-Based / Remote Position Overview Are You a Security Architect Who Knows How to Build Bulletproof Systems for a Fast-Moving Remote Team? If you think in threat vectors, obsess over access controls, and see every IT gap in a remote environment as a chance to build something more secure and friction-free, this role is for you. At Organics Ocean, we're looking for an IT Operations & Cybersecurity Manager who will own and evolve the company's entire IT infrastructure, access control and cybersecurity strategy. This is a highly autonomous, individual contributor role with high ownership. You will be the subject matter expert responsible for designing and implementing the company's security architecture, including determining the right approach to identity management, network access and system protection. You will own the strategy, execution, and continuous improvement of our security ecosystem, from zero-trust frameworks and endpoint protection, to incident response and automation. You will be empowered to make expert-driven decisions, define architecture and implement initiatives that materially reduce risk and enable the business to scale securely. This is a hands-on, outcomes-driven role. If you're looking for a purely advisory position or one that rubber-stamps vendor recommendations, this won't be a fit. This role requires prior experience supporting a fully remote or distributed company. Candidates without this experience will not be considered. Who We Are: Organics Ocean We are a premium direct-to-consumer supplement brand helping people live healthier lives through science-backed, clean, and effective products. We're not a company where things stay the same. We test, we optimize, we innovate and we want someone who thrives in that kind of high-accountability, fast-paced environment. Why join our team? • High-growth eCommerce brand: Driven by innovation and fast execution, Organics Ocean has seen 350% year-over-year growth. • Ownership & Accountability: We trust our team members to take full ownership of their responsibilities. You are empowered to lead, execute, and improve without micromanagement. We value individuals who take initiative, hold themselves accountable, and drive meaningful results. • A team of high performers: We push boundaries, move fast, and get things done. The company is in a hockey stick growth phase. This is not a good fit for those who don't want to grow. Responsibilities Security Architecture & Access Strategy (Primary Focus) • Own and define the company’s overall security and access architecture • Evaluate, design, and implement the most effective approach to securing systems, which may include: • Single Sign-On (SSO) • VPN or network-based security • Identity-first or zero-trust frameworks • Or a hybrid approach • Establish and enforce best practices for: • Authentication (MFA, device trust, etc.) • Authorization and access controls • Secure system access across a remote workforce • Serve as the final decision-maker and expert on how systems are secured across the organization Identity & Access Management • Design and maintain role-based access controls (RBAC) based on: • Department • Role level • Employment type (employee vs contractor) • Own provisioning and deprovisioning of: • Email accounts • SaaS tools • System permissions • Build and maintain scalable onboarding and offboarding workflows • Ensure centralized visibility and control over all system access Endpoint & Hardware Management • Oversee full lifecycle of company devices: • Procurement, setup, shipping, recovery • Implement and enforce endpoint security standards (MDM, encryption, monitoring) • Enable remote lock, wipe, and shutdown capabilities • Maintain accurate inventory of company-issued hardware • Manage vendors or external partners supporting IT operations (if applicable) Cybersecurity & Risk Management • Own and continuously improve the company’s cybersecurity posture • Proactively prevent and respond to: • Phishing attempts • Account takeovers and impersonation • Unauthorized system access • Protect critical systems and data, including: • Financial systems • Shopify and eCommerce infrastructure • Customer and marketing data • Act as the first responder for security incidents, leading investigation and resolution • Establish, document, and continuously improve incident response protocols • Conduct regular audits of access, permissions, and vulnerabilities Automation & Technical Enablement (Value-Add) • Build and maintain automations using tools like: • Zapier • Make (Integromat) • Reduce manual work by integrating systems and streamlining workflows • Partner with teams to identify and implement efficiency opportunities Requirements • 5+ years in IT operations, cybersecurity, or IT systems management • Direct experience designing and implementing security architecture for a company • Experience supporting a fully remote or distributed company (required - candidates without this will not be considered) • Proven experience evaluating and implementing solutions such as: SSO platforms (Okta, Rippling, Google Workspace, Azure AD, etc.), VPNs or network security solutions and identity-first or zero-trust frameworks • Demonstrated ability to choose and implement the right security approach based on company needs, not follow a preset system • Acts as a true owner and expert — makes informed, high-quality decisions independently without hand-holding • Deep understanding of Identity & Access Management (IAM), endpoint security/MDM tools and SaaS-based infrastructure environments • Experience with MFA and advanced authentication methods, access control systems and permission frameworks and security incident response and remediation • Proactively identifies risks and implements preventative solutions before they become incidents • Strong systems thinker who builds scalable, durable processes, not one-off fixes • Clear communicator who can translate technical decisions into business impact for non-technical stakeholders • High integrity and discretion when handling sensitive systems and data • Familiarity with automation tools (Zapier, Make, APIs) preferred Preferred • Experience in eCommerce or high-growth DTC environments • Familiarity with platforms like Shopify, Gorgias, and marketing tech stacks • Experience operating in fast-paced, high-accountability environments Additional Requirements: • Willingness to work US time zones, regardless of geographic location • Access to a computer • Reliable internet connection • Reliable and distraction-free work environment • Occasional travel may be required Offer Details • This is a full-time, remote, W-2 employee position. • Pay is $135K-$160K/year. Actual compensation within the range will be dependent upon the individual's skills, experience, qualifications and location, and applicable employment laws. • Healthcare, dental, and vision plans are available. What Success Looks Like First 90 Days • Architecture Defined: Clear assessment of current landscape completed; security and access strategy approved. • SSO Implementation: SSO system (Rippling or equivalent) is fully implemented and adopted across the org. • Standardized Workflows: All employees and contractors are onboarded/offboarded through enforced IT workflows. • Leadership Liberation: Leadership is no longer involved in access setup, security troubleshooting, or software permission issues. • Response Ready: A clear, documented incident response process is communicated to the team. 6–12 Months • Hardware Program: Launch program for employees within the first 6 months of employment. • Zero Incidents: