Manager, Corporate IT & Security

Todyl is seeking a hands‑on Manager, Corporate IT & Information Security to lead and operate our internal corporate technology, information security, and compliance programs. This role is responsible for the performance, reliability, and security of Todyl’s internal IT environment across three office locations, including our Microsoft ecosystem, corporate endpoints and SaaS applications, identity and access management, internal use of the Todyl platform, physical security systems, and the overall corporate security program.

This is a player‑coach role for a leader who is equally comfortable setting direction, building programs, and personally executing. You will manage a lean internal IT function, including one team member responsible for day‑to‑day help desk support, while directly owning core systems, escalations, security operations, and key technology initiatives.

This role also owns Todyl’s internal compliance program, including SOC 2, CMMC, and other applicable security and regulatory frameworks. You will be responsible for maintaining audit readiness, strengthening controls, managing evidence and remediation, and partnering cross‑functionally to ensure our internal environment scales securely and in alignment with company obligations.

This is not a pure policy or oversight role. It is a hands‑on leadership position with direct accountability for Todyl’s internal corporate technology, security posture, and compliance execution.

• Own Todyl’s internal IT environment, including corporate productivity systems, endpoints, identity, device management, collaboration tools, and core SaaS applications.
• Serve as the primary owner of Todyl’s Microsoft infrastructure and tenant, including administration, security, governance, and lifecycle management across Microsoft 365, Entra , Intune, Exchange, Teams, SharePoint, and related services, in partnership with SRE where appropriate across the Microsoft ecosystem.
• Own and continuously improve Todyl’s internal use of the Todyl tenant and platform to protect the corporate environment.
• Lead IT operations for onboarding, offboarding, access provisioning, endpoint standards, asset management, license management, support escalation, and overall end‑user experience across three office locations.
• Manage and develop the help desk team member while serving as the escalation point for complex or high‑impact issues.
• Establish and maintain standards for endpoint configuration, patching, hardening, backup, recovery, and business continuity.
• Oversee corporate physical security technology and controls across three office locations, including badge access systems, visitor access processes, and video surveillance systems.

• Own and lead Todyl’s corporate information security program, including policies, standards, technical controls, operational processes, and ongoing security maturity.
• Design, implement, and improve security controls across identity and access management, endpoint protection, logging and monitoring, vulnerability management, data protection, SaaS security, configuration management, physical security controls, and incident response.
• Lead security monitoring, triage, investigations, and response coordination for internal corporate systems and events, partnering with MXDR and Advanced Threat Operations for escalation and coordinated response as needed.
• Drive company‑wide security awareness, phishing resilience, and training initiatives to strengthen security culture and employee readiness.
• Partner with Engineering, Product, and leadership to ensure internal security practices align with broader business and platform risk priorities.
• Provide regular reporting to leadership on internal security posture, material risks, remediation progress, and control maturity.
• Own Todyl’s internal compliance program, including SOC 2, CMMC, and other applicable frameworks and customer‑driven requirements.
• Lead internal and external audits for SOC 2, CMMC, and other applicable frameworks, including audit readiness efforts, control design, evidence collection, gap assessments, remediation planning, and…