Manager, IT & Information Security at ClarityPay in New York, NY

Job description

About Us: At ClarityPay, we’re redefining the point-of-sale credit market to bring more value to merchants. Based in NYC and Atlanta, our fast-growing fintech empowers large merchants with configurable “Pay-Over-Time” tools— including monthly installments, BNPL, and revolving products. We solve complex credit challenges with speed, precision, and intelligence—combining deep expertise with advanced tech to deliver better outcomes, every time. Our clients rely on us to help them serve their customers, grow, and build loyalty. Our values guide everything we do: we put merchants first, stay data-driven, always know the why, learn relentlessly, and win together as a team. This clarity of purpose fuels our commitment to delivering exceptional customer experiences at speed and scale. Role Overview: ClarityPay is seeking a Manager of IT & Information Security to build and run the technology backbone of the company. This is our dedicated IT and security hire, and it is a hands-on, build-it-yourself role: you will personally provision laptops, administer our SaaS stack, grant and revoke access, and answer the help request — while also standing up the policies, controls, and vendor relationships a regulated fintech needs as it scales. You will own corporate IT, identity and access management, endpoint and email security, incident response, and business systems administration, and you will be the internal owner of the evidence and controls that support our SOC 2, PCI DSS, and partner-bank security reviews. Today this work is spread across the executive team; your first mandate is to consolidate it, document it, and make it reliable. This is an on-site role based in our New York office, with a minimum of four days per week in the office. This role collaborates closely with Engineering, Data, Operations, Risk, Compliance, Legal, Finance, and People, and offers a clear path to grow into leading a small team as the company scales. Key Responsibilities: Own end-to-end IT operations for the company: laptop and device procurement, imaging, deployment, inventory, refresh, and secure decommissioning across the New York and Atlanta offices and remote staff. Own identity and access management: provision and de-provision accounts, administer SSO and MFA, enforce least-privilege and role-based access, and run periodic access reviews with documented evidence. Administer the corporate SaaS and business systems stack (e.g., Microsoft 365 and email, Slack, Retool, HRIS, e-signature, and the productivity and AI tools employees rely on), including configuration, integrations, and license and spend management. Production and cloud infrastructure remain owned by Engineering; you partner with them on shared controls. Create, secure, and manage corporate email — accounts, distribution lists, aliases, shared mailboxes, domain records (SPF, DKIM, DMARC), and anti-phishing and data-loss controls. Own endpoint security: MDM enrollment, disk encryption, patch and vulnerability management, EDR/antivirus, and configuration baselines for every company device. Run the day-to-day help desk with clear SLAs — triage, resolve, and escalate employee requests, and track recurring issues to root cause rather than repeat fixes. Own new-hire onboarding and offboarding from an IT and security standpoint: day-one readiness (device, accounts, access, training) and same-day access removal at exit, coordinated with People and hiring managers. · Serve as the internal owner of information security operations: security monitoring and alerting, incident detection and response, tabletop exercises, and post-incident reviews. · Produce and maintain the controls, documentation, and audit evidence supporting SOC 2, PCI DSS, and partner-bank and merchant security reviews, partnering with Risk, Compliance, and Legal, who own the frameworks and auditor relationships. · Lead third-party and vendor security reviews and due diligence, and maintain the vendor inventory and associated risk documentat