Information Security and Compliance Specialist (Microsoft 365)

Location: Lexington, Kentucky, United States; in-office work with periodic travel to Nashville, Washington, DC, and client sites

Company

hirify.global is a technical services firm handling large project datasets and client-controlled information.

What you will do

• Own the security program, define the secured-environment boundary, maintain policies and records, and lead readiness reviews, audits, and annual confirmations.
• Design, build, and administer the on-premises secured environment, including storage, compute, network segmentation, access control, remote or virtual desktop access, encryption, and capacity planning.
• Administer Microsoft 365, Entra ID, multifactor authentication, conditional access, sharing policies, data loss prevention, and the encrypted correspondence platform.
• Design and operate backups with local replication, offline or offsite copies, restore testing, removable-media controls, chain-of-custody records, and secure destruction.
• Manage logging, vulnerability scanning, patch and configuration baselines, incident response exercises, client reporting, user access reviews, and security training.
• Prepare the security-program budget, maintain asset and lifecycle records, and contribute to IT continuity and disaster-recovery procedures.

Requirements

• Bachelor's degree in information systems, cybersecurity, computer science, or a related field; demonstrated equivalent experience may substitute.
• Five or more years administering business IT infrastructure, including Windows Server, Microsoft 365, Entra ID, group policy, and network segmentation.
• Experience configuring and supporting remote desktop or virtual desktop environments.
• Experience designing and operating backup programs with offline or offsite copies, snapshot replication, and documented restore testing.
• Experience managing user access, including account setup, periodic access reviews, and removal.
• Experience writing procedures, policies, or training materials that non-IT staff can follow.
• Experience working within a documented security or quality framework such as ISO 27001, SOC 2, HIPAA, PCI, or an internal audit program, with the ability to learn and own the firm's requirements.
• U.S. citizenship required.

Nice to have

• Security+, CISSP, CISM, CISA, Microsoft 365 or Azure administrator certification, or a comparable credential.
• Experience with government-grade encryption, tape libraries, enterprise NAS snapshot replication, site-to-site VPN, managed security service providers, IT procurement, and departmental budgeting.
• Experience protecting large technical datasets or working in an architecture, engineering, surveying, or construction firm.
• Exposure to client-mandated security requirements and eligibility for a background investigation.

Culture & Benefits

• Full-time, exempt position reporting to the CEO and working alongside the firm's IT lead.
• 401(k) with company match, comprehensive health, dental, vision, and life insurance.
• Paid time off and employee referral program.
• Professional development support, including security training and certification funded by the firm.
• Work emphasizes candid reporting of gaps, accurate records, coordinated control design, client service, confidentiality, and respectful conduct.