IT Security Specialist

This role will own key areas of our corporate security environment, including endpoint security, identity and access management, Google Workspace, SaaS security, security monitoring, security awareness, and AI security. We’re looking for an experienced practitioner who understands that, in a modern company, the browser is often the operating system through which people access data, applications, and business workflows. In this role, you will:

• Own security for Axios’ Mac fleet, including Jamf, compliance, monitoring, alert investigation, malware response, and device remediation.
• Own Okta-based identity and access management, including adaptive MFA, authentication, SSO, application assignments, access scopes, and joiner/mover/leaver processes.
• Partner with People, Legal and Infrastructure to improve provisioning, offboarding, access removal, archival, legal holds, and lifecycle automation.
• Establish and maintain security configurations and risk controls for core services and SaaS applications, including authentication, access, collaboration, email security, data protection, alerting, activity monitoring, vendor and procurement reviews, security questionnaires, evidence gathering, and recommended safeguards.
• Treat the browser and SaaS layer as critical security boundaries, evaluating how users access data and applications and where browser-based workflows create risk.
• Use logs and activity monitoring across endpoints, browsers, identity systems, Google Workspace, and SaaS applications to investigate suspicious activity and support incident response.
• Assess systems, tools, permissions, and workflows for security, operational fit, and long-term supportability.
• Help protect high-risk users, including journalists and executives, through appropriate privacy, account-security, and personal-data protections.

Security awareness and AI security

• Own security awareness programs, including human risk, phishing simulations, reporting workflows, completion tracking, and targeted training for higher-risk users.
• Design and deliver customized training for different parts of the company, including the newsroom, journalists, business teams, and technical teams, based on their workflows and threat models.
• Develop practical AI security policies and guidance, and review AI tools, automations, agents, and internally built solutions for data handling, permissions, authentication, authorization, secrets management, logging, monitoring, human oversight, and operational readiness.