Company Overview Smart Communications is a leading technology company specializing in Corrections technology solutions. We serve county jails and state prisons nationwide, delivering innovative tools to enhance security and operational efficiency within correctional facilities. Why this role exists We run mission-critical infrastructure for correctional facilities across the country, and our CJIS obligations are specific and enforceable. Separately, our deployment process has matured into a controlled pipeline. This role brings those together. You will own how code reaches production, own the credentials and access that make production work, and own the security posture we can actually demonstrate to an auditor or a customer. That work builds toward CJIS and SOC 2. What you'll own Deployment and release

• Own the CI/CD pipeline end to end — GitHub Actions, Nomad, and whatever we adopt alongside them
• Make deployments repeatable, reviewable, and reversible, and make the record of what shipped and who approved it something we can hand to an auditor without assembling it by hand
• Support the development teams using the pipeline, and reduce the number of paths to production that bypass it
• Build out infrastructure-as-code and configuration management so that environments are described rather than remembered Asset and version inventory
• Maintain an authoritative record of what we run and what version — operating systems and firmware across Proxmox hosts, Windows Server, Ubuntu and Debian, network and voice equipment, and the legacy systems still carrying production traffic
• Track versions of our own applications in production, along with their dependencies and bundled packages, and generate a software bill of materials as part of the build
• Make the inventory answer the question that actually matters when a vulnerability is announced: do we run it, where, and at which version
• Surface end-of-life and unsupported-version exposure far enough ahead that it's a budget conversation instead of an emergency Credentials and access
• Inventory every credential we have: service accounts, API keys, certificates, SSH keys, and database logins
• Machine credentials stored in a secrets manager with automated rotation, and confirm they are not in configs, scripts, or shared vaults
• Consolidate identity across Microsoft Entra and Google SSO, and get MFA coverage to where CJIS requires it — company-wide, across every location and our remote staff
• Run periodic access reviews and produce evidence, not just a feeling Security posture and compliance
• CJIS Security Policy compliance
• Own inbound security questionnaires from customers and prospects — become the person who answers them accurately and quickly
• Build the control foundation that SOC 2 readiness sits on: logging and monitoring coverage, vulnerability management, backup and restore verification, incident response procedure Who you'll work with This role is in Systems Operations, but works across every technical team.

A lot of what it accomplished requires other people, which makes the working relationships as important as the technical work.

• Engineering — pipeline and release process, software bill of materials, remediating vulnerabilities in our own code and its dependencies, secure defaults in what we build
• Systems Operations — patching cadence, hardening, server lifecycle, datacenter access control, and the operational reality of every control you design
• Network Operations — segmentation, firewall policy, remote access, and the end-user network side of anything that touches criminal justice information
• Internal IT Support — endpoint posture, employee identity and MFA, onboarding and offboarding.

Worth knowing:

this is company-wide, covering every location and our remote staff, so the identity and access work reaches well beyond Vancouver. What this role is not Being explicit, because the boundary matters:

• You will not be the sole approver of your own changes. Change approval stays with the System Operations Manager. This is deliberate — an auditor will expect the person who builds and deploys not to be the only person attesting that deployment controls work. It is a design decision, not a statement about trust.
• You are not being asked to become a full-time compliance officer. This is an entry level security role. For SOC 2 compliance expertise, it is alongside you rather than dropped on you.
• You are not the help desk for security questions you have not been given time to answer. Part of this role is establishing what you own and what routes elsewhere. Required qualifications
• Working knowledge of our production environment — Proxmox, Linux, Windows Server, and the applications that run on them
• Demonstrated experience building or substantially operating a CI/CD pipeline, and supporting other people in using it
• Scripting in PowerShell, Python, or Bash sufficient to automate real work
• Solid networking fundamentals and comfort troubleshooting at the packet and service level
• Clear written documentation habits. A large share of this role is producing artifacts that a third party will read and evaluate.
• Demonstrated ability to carry a long-running project alongside interrupt-driven work without the project stalling
• Comfortable working across teams you don't manage, and a track record of getting things done through people
• Willingness to learn compliance frameworks from a standing start, and the temperament to find control design interesting Preferred qualifications
• Familiarity with the CJIS Security Policy, or experience in any externally audited environment
• Secrets management tooling — HashiCorp Vault, CyberArk, or similar
• Infrastructure as code — Terraform, Ansible, or equivalent
• Software composition analysis or SBOM tooling — Syft, CycloneDX, Trivy, GitHub dependency graph, or similar
• Asset or configuration management databases, or any prior experience keeping an inventory accurate over time
• Identity administration in Microsoft Entra, Google Workspace, or another IdP, including MFA rollout
• Exposure to

SOC 2, ISO 27001, PCI

DSS, or any formal audit process, from any side of it

Certifications:

CompTIA Security+, ISACA

CISA, ISC2

CISSP, HashiCorp Vault Associate, Terraform Associate, or Red Hat automation credentials

• Experience writing or responding to customer security questionnaires Time, schedule, and location You will remain part of the Systems Operations team.

The expectation is that most of your time — roughly three quarters or more — goes to the responsibilities above, with the balance still available for Systems Operations work. That split will flex in practice, and will shift again as the team grows.

• Primary office: Vancouver, WA 98682 — remote work is not an option
• Hillsboro, OR 97124 — one to two times per month, day trips
• Out of state — potentially a few trips per year
• Monday-Friday, five 8-hour shifts

On-call:

one week at a time, rotating across the Systems Operations team — including the manager

• Most after-hours maintenance is scheduled in advance.

Occasionally an urgent change has to happen outside a planned window.

Pay:

$88,000.00 per year

Benefits:

401(k) Dental insurance Health insurance Life insurance Paid time off Vision insurance

Work Location:

In person