HRS Group
Website:
hrs.com
Job details:
The Opportunity
We are a 900-person globally distributed scale-up with 20 offices across Germany, France, USA, Italy, Vietnam, India, and beyond. We move fast, run lean, and expect every function to own its outcomes commercially and operationally.
This is not a role for someone who manages vendors and escalates incidents. It is a role for someone who maps the global architecture, automates the helpdesk, negotiates vendors hard, and co-creates a state-of-the-art security posture - simultaneously, from day one, with a lean team and a clear mandate.
If you are at a stage in your career where you still want to build things personally, where you find vendor negotiations energizing rather than administrative, and where "we've always done it this way" makes you impatient - this role was designed for you.
What You Own
Global IT infrastructure across 20 offices
You are the single accountable owner of everything that keeps a scale-up global people tribe productive: endpoints, office networks, leased lines, meeting room A/V, printers, WeWork and owned office infrastructure, telecom contracts, and the remnants of on-premise data centers we are actively rationalizing.
Service delivery automation
The current L1/L2 model is manual. Your mandate is to change that within two quarters. Every ticket that does not require a human hand on hardware should be automated end-to-end. You start building this in parallel with the current manual operation from week one - not after a discovery phase, not after a budget approval cycle.
Global IT architecture
You map the current state, maintain it as a live artifact, and always have the next two architectural steps planned and sequenced. You own the execution path across your direct team and matrix stakeholders. The architecture is never a static document - it reflects decisions made and decisions coming.
SaaS vendor commercial management
Our SaaS estate includes Microsoft 365, Dynamics CRM, Zammad, and various other tools. These are significant contracts. You negotiate them, not just administer them. License utilization, renewal positioning, and commercial leverage are your responsibility. This extends to telecom contracts, leased lines, and every other vendor relationship in your domain.
Zero trust security posture for corporate IT
You own the cybersecurity architecture for the corporate IT estate - endpoints, identity, office networks, and SaaS access controls. You design and implement proactively: Conditional Access policies, device compliance enforcement, network segmentation, least-privilege access design. This is not a future aspiration - it is a current accountability. Production cloud security sits with our DevSecOps team; the boundary is clear and the collaboration model is defined.
Team leadership
You manage 6 direct reports across India and Europe, including two Germany-based colleagues. You also manage an L1 resource supported by HelloID automation and a third-party emergency service for our Cologne headquarters. You develop the team's capability actively - particularly in automation and security - and you raise the bar, not just maintain it.
What The First 12 Months Look Like
Month 1: You deliver a current-state global IT architecture map, a full vendor landscape audit with renewal dates and costs, a classified ticket automation backlog with tooling recommendations, and an initial zero trust gap assessment. You have met every direct report individually and established the on-call coverage model.
Months 1–3: You are building automation in parallel with the existing manual operation. First automated workflows are live. Top vendor renegotiations are initiated with documented commercial positions. The zero trust gap assessment is complete with a prioritized remediation plan.
Months 3–6: The majority of non-hardware L1/L2 ticket volume is automated. At least two major vendor contracts are renegotiated with measurable savings. Conditional Access policies and device compliance baselines are live. A SaaS governance framework - user lifecycle, role hygiene, license reclamation - is operational.
Months 6–12: You own the annual IT budget with full variance accountability. Automated ticket resolution exceeds 70% of eligible volume. You present the annual IT efficiency report: cost per employee, contract savings versus prior year, incident reduction, automation coverage, and zero trust posture progress.
What You Bring
You have 10–14 years of experience in corporate IT infrastructure, with at least 3–5 years in a role where you owned outcomes end-to-end - not just contributed to them.
You have personally automated L1/L2 workflows. You can name the tool, describe the logic, and state the before-and-after outcome. You have done this with modern lightweight platforms - Freshservice, Rezolve.ai, n8n, Make, Unthread or equivalent. You have not relied on a platform team or a ServiceNow implementation to do it for you.
You have sat across the table from a vendor and changed the commercial outcome. You can name the vendor, the lever you used, and the saving. You did not hand this to procurement.
You have implemented zero trust in practice. Entra ID Conditional Access, device compliance policies, Zscaler integration, network segmentation - you have configured these, not just designed frameworks for others to build. You understand defense-in-depth and have applied it in a corporate IT context.
You have maintained a live global IT architecture. You know which tool you used, how often you updated it, and how it connected to planning decisions. It was not a diagram you made once and filed.
You are comfortable managing across cultures. Your stakeholders include colleagues in Germany, France, Italy, Vietnam, and India. You adapt your communication style without losing directness, commercial edge, or technical precision.
You are genuinely hands-on. At this stage of your career you still build things yourself - workflows, runbooks, architecture documentation, negotiation briefs. You do not manage by delegating everything downward. This is a point of pride for you, not a gap to grow out of.
Technical Fluency Expected
- Microsoft 365 E5: tenant architecture, Entra ID, Conditional Access, Exchange, Teams, licensing optimization
- Zscaler: ZIA/ZPA configuration, integration with M365 and Entra ID
- HelloID: identity lifecycle automation, extending current automation scope
- Modern ITSM: Freshservice or equivalent lightweight platform - not ServiceNow
- Workflow automation: n8n, Make, or equivalent for connecting SaaS systems without custom code
- Network infrastructure: LAN/WAN, SD-WAN, leased line management across multi-site environments
- MDM: Intune or equivalent for device compliance and endpoint management
- Architecture tooling: Lucidchart, Ardoq, LeanIX, or equivalent for live architecture documentation
What This Is Not
This is not a role where you inherit a mature function and optimize at the margins. There is no large procurement team behind you, no legal team on call, and no change management committee to approve your decisions. You have a lean team, a real mandate, and full accountability. If that sounds like a constraint, this is not the right role. If that sounds like exactly the environment where you do your best work, keep reading.
Why Join Us
- Real ownership of a global function from day one
- Mandate to build what does not yet exist - automation capability, live architecture, zero trust posture
- Direct commercial authority over a significant vendor and contract portfolio
- A lean, fast-moving organization where your decisions have visible impact
- Competitive compensation plus performance bonus tied to cost efficiency, automation milestones, and security posture KPIs
Click on Apply to know more.