Helcim runs on two kinds of technology: the payments platform we sell, and the network, laptops, internal systems, and automation we run on. The second is Business Technology. We want getting access, automating a workflow, or building something with AI to be fast and safe for everyone here, and this role spends most of its time getting us there. You'd be the most senior individual contributor on a small team, reporting to Marcos, our Head of IT Infrastructure, with real say in what this function becomes.

What's hard about it

As the most senior IC on a small team, you'll be expected to bring proposals and disagreements instead of waiting for direction. Nobody on the team has a lane they stay in. Everyone covers support, provisioning, and onboarding, so the automation you want to build competes with the ticket in front of you. Cybersecurity decides which tools and policies we adopt, and you make them work for every employee, including the ones who'd rather they didn't.

• 5+ years in IT, systems administration, or a closely related role, with real depth in Shell, Python, or Go. REST APIs and webhooks are your first instinct, and your scripts live in a repository with a README, not on a laptop.

• You've run access administration at fleet scale, including Google Workspace provisioning and deprovisioning, and rolled out SSO, SAML, and SCIM company wide on the deployment side.
• You've managed Windows and macOS endpoints with Intune and Jamf (or close equivalents), including policy and compliance baselines.
• You know networking well enough to own a corporate environment: firewalls, VLANs, wireless, DNS.
• You've built with LLM-based tooling: integrations and agents, and you can judge whether the output can be trusted. Prompt writing alone doesn't count.
• You can break an unfamiliar, underspecified problem into parts, and you write documentation other people act on.

What you don't need

• A compliance background or audit experience. It helps, and you can learn what audit evidence looks like here.
• A degree in a specific field. [confirm: the original posting asks for a technical diploma or degree. Is that waivable?]
• Go. Shell or Python is enough.
• Our exact tooling. Intune and Jamf or their equivalents are what matter, so the product names matter less.
• A history on a small team where you defined the role. If you've done it, great. If not, you'll learn fast.

• Integration and automation: Configuring the connectors, MCP servers, and approved scripting patterns that let people who aren't engineers program our internal systems. You'll automate our recurring work (onboarding and offboarding, provisioning, license reconciliation, access reviews, asset records) and administer the sanctioned AI toolkit as it changes.
• Access and provisioning: Moving access to non-critical systems toward same-day or self-serve, scoped narrowly enough that granting it is routine. That covers Workspace, Jira, Confluence, and our AI tooling.
• Security tooling rollout: Deploying what Cybersecurity picks across internal technology, including the identity provider.
• Day-to-day coverage: Support, provisioning, and onboarding, shared across the whole team.
• Network, endpoints, and monitoring: Shared ownership of the network, the endpoint fleet, and internal systems, with monitoring and alerting that surface problems before anyone reports them.
• Documentation and teaching: Runbooks someone else can extend, contributions to the company knowledge base and the team's how-to communications, and pairing and reviewing so the team's capability grows beyond your own output.