About Us

Epic Kids is the leading digital reading platform built for kids 12 and under, trusted by millions of children, educators, and families around the world. Our mission is to inspire a lifelong love of reading by providing unlimited access to thousands of high-quality books, videos, and educational content through a safe and engaging experience. We combine technology, storytelling, and learning innovation to help every child become a confident reader.

At Epic, you'll join a collaborative and fast-paced global team passionate about building meaningful products that make a real impact on children's education and literacy.

About the Role

The IT Systems Administrator runs Epic's day-to-day IT operations and keeps them continuously audit-ready. The scope covers corporate identity and access, endpoint and application management, and employee IT support. As the dedicated IT function of a small company, you will work from goals and requirements set by technology leadership, with wide ownership of how the work gets done. Part of that work is maintaining the access records, change history, and control evidence that audits and security reviews rely on. You will partner closely with infrastructure, engineering, and people operations on onboarding and offboarding, access reviews, and Epic's compliance program.

This is a fully remote, US-based role working closely with a global engineering team.

What You'll Do

• Administer corporate identity and access across Google Workspace and our core business applications -- accounts, groups, roles, and least-privilege permissions

• Evolve the identity stack -- single sign-on, lifecycle automation, and identity tooling as needs grow

• Own the user lifecycle end to end -- provisioning at hire, changes at role transitions, and complete, timely deprovisioning at exit

• Run periodic user access reviews across in-scope systems and drive the remediation they surface to closure

• Enforce authentication and device standards -- multi-factor enrollment, encryption, patching, and configuration baselines

• Own device provisioning -- MDM enrollment and laptop setup, including zero-touch deployment

• Produce and maintain evidence for IT-owned controls, and support audits, customer security questionnaires, and vendor security reviews

• Maintain the inventory of applications, hardware assets, and the access each grants

• Handle day-to-day IT support for employees

• Define and document IT procedures and keep runbooks current

• Partner with infrastructure and people operations on policy rollout, security-awareness training completion, and incident response for IT-owned systems

What We're Looking For

Required Qualifications

• 5+ years in IT administration or IT operations, with hands-on identity, endpoint, and business-application administration beyond ticket-queue support

• Experience supporting a formal compliance program (SOC 2, ISO 27001, or similar) -- access reviews, evidence collection, and working with auditors

• Working knowledge of identity and access management -- single sign-on, multi-factor authentication, and user lifecycle management

• Experience administering Google Workspace or a comparable productivity and identity suite

• Strong troubleshooting across hardware, operating systems, networking, and SaaS applications

• Clear communication and documentation, supporting both technical and non-technical employees

• Bachelor's degree or equivalent practical experience

Preferred Qualifications

• Experience managing a macOS fleet with a modern MDM platform (Jamf, Kandji, Intune, or similar)

• Experience implementing conditional / context-aware access (geo- and network-based restrictions)

• Familiarity with data-residency and privacy requirements (COPPA, FERPA, GDPR)

• Experience with a compliance automation platform (Vanta, Drata, or similar)

• Experience with identity-governance or access-review tooling (SailPoint, Certalign, Lumos, or similar)

• Experience with SSO integrations using SAML and SCIM

• Scripting to automate routine administration (Python, Bash, or PowerShell)