🎯 招聘雷达

Director of IT and Workplace
Director of IT and Workplace
IT 与办公场所总监
Hippocratic AI · Menlo Park
安全面议remoteokremote_ok

📚 学习点

📄 原文

The Role We've grown to roughly 265 people working onsite from our Menlo Park headquarters, supported by a large network of remote U.S.-licensed clinicians — and part of the Series C is earmarked for acquisitions. The systems and the spaces holding all of that together were built for a much smaller company. We're hiring a Director of IT & Workplace to own them properly. You'll own two halves of the same problem: the employee technology platform — identity, endpoints, networking, the SaaS portfolio, and our IT security posture — and the physical environment the company runs on, from space planning and physical security to the AV that customer demos and all-hands depend on. You'll inherit a small, capable team and be accountable for leveling it up. You'll be the named owner for IT controls in our HIPAA and SOC 2 programs, you'll own the IT and workplace budget, and when we acquire a company, you'll be the one integrating it. Our Environment Identity and access: Okta for SSO, MFA, and lifecycle provisioning. Productivity: Microsoft 365 and Google Workspace, both in active use across the company. Endpoints: a Mac-primary fleet with Windows machines alongside it, managed through MDM. VDIs included. Internal systems: IRU, plus a growing portfolio of internal and third-party SaaS applications. Workplace: a Palo Alto headquarters with conference room AV and access control, plus a distributed clinician and staff population. What You'll Do Strategy, budget, and team Own a multi-year IT and workplace roadmap tied to the hiring plan, and bring it to leadership with clear tradeoffs and funding asks. Own the IT and workplace operating and capital budget: forecast it, defend it in planning cycles, and continuously rationalize license, vendor, and facilities spend. Lead, coach, and grow the existing team — set clear expectations, run honest performance conversations, hire as scope deepens, and build career paths that keep strong people. Define and publish service levels for ticket response, uptime, onboarding readiness, and workplace turnaround, and report against them to the executive team. Technology and infrastructure Own the identity platform: SSO, MFA, automated joiner-mover-leaver provisioning in Okta, and access governance across every connected application. Own the endpoint fleet and the SaaS portfolio — Microsoft 365, Google Workspace, IRU, and a long tail of business applications — with enforced MDM baselines for encryption, patching, and configuration. Own network and connectivity for the headquarters and the remote workforce, with redundancy appropriate to a company our customers depend on. Replace manual provisioning, access reviews, and device setup with scripted, auditable workflows. Lead major programs end to end: platform migrations, upgrades, office buildouts, and the IT and workplace integration of acquired companies. Security, compliance, and risk Serve as the accountable owner for IT controls in our HIPAA, SOC 2, and customer security review programs, including evidence collection and audit response. Enforce least privilege across the environment and run recurring access certifications with documented outcomes. Partner with Security on incident response and vulnerability remediation, and with Legal on data handling, retention, and discovery requests. Own business continuity and disaster recovery for corporate systems — write the plans, test them, and fix what the tests expose. Treat protected health information and confidential data with the care our customers and their patients expect. This is non-negotiable in everything we do. Workplace and facilities Own day-to-day operations of the headquarters, and lead space planning and buildouts against a hiring plan that keeps moving. Manage physical security — access control and badging, visitor management, cameras, and emergency preparedness — aligned with our compliance obligations. Own conference room and event AV, including all-hands and customer visits, to a standard where the technology is never the story. Support remote clinicians and staff with reliable equipment logistics, home office standards, and consistent service regardless of location. Manage facilities, AV, security, and food vendors, plus landlord and lease matters, in partnership with Finance and Legal. What You'll Bring 8+ years in IT , spanning hands-on administration or engineering and progressively senior ownership. You've done the work you'll now be leading. 3+ years managing IT or workplace teams , including hiring, performance management, and developing people into bigger roles. Proven ownership of an IT function through rapid growth. You've scaled systems and process ahead of headcount, not behind it. Deep technical expertise across identity (Okta or comparable), Microsoft 365 and Google Workspace, MDM at fleet scale, and corporate networking. Experience as a named control owner in a regulated environment — HIPAA, SOC 2, or HITRUST — including sitting across the table from auditors. Budget ownership and vendor negotiation experience , with the financial fluency to frame a risk or a funding ask so a CFO can act on it. Workplace or facilities exposure — buildouts, moves, physical security, or lease management — or a genuine appetite to own it and learn quickly. Willingness to stay close to the work. This is a leadership role at a company where the director still unblocks a broken demo when it matters. Education: Bachelor's degree in Information Technology, Computer Science, or a related field, or equivalent experience. We weigh demonstrated ability over credentials. Nice to Have Healthcare, life sciences, or another environment handling sensitive personal data at scale. IT integration of an acquisition, or standing up a function's first access governance or asset management program. Automation depth (Python, Bash, PowerShell) and experience managing devices and infrastructure as code. Certifications such as Okta Certified Administrator, Microsoft 365 Enterprise Administrator, Jamf, CISM, CISSP, or ITIL. Why Join Hippocratic AI Reinvent healthcare with AI that puts safety first. We’re building the world’s first healthcare‑only, safety‑focused LLM — a breakthrough platform designed to transform patient outcomes at a global scale. This is category creation. Work with the people shaping the future. Hippocratic AI was co‑founded by CEO Munjal Shah and a team of physicians, hospital leaders, AI pioneers, and researchers from institutions like El Camino Health, Johns Hopkins, Washington University in St. Louis, Stanford, Google, Meta, Microsoft, and NVIDIA. Backed by the world’s leading healthcare and AI investors. We recently raised a $126M Series C at a $3.5B valuation, led by Avenir Growth, bringing total funding to $404M with participation from CapitalG, General Catalyst, a16z, Kleiner Perkins, Premji Invest, UHS, Cincinnati Children’s, WellSpan Health, John Doerr, Rick Klausner, and others. Build alongside the best in healthcare and AI. Join experts who’ve spent their careers improving care, advancing science, and building world‑changing technologies — ensuring our platform is powerful, trusted, and truly transformative. Equal Opportunity Hippocratic AI is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, national origin, sex, age, disability, sexual orientation, gender identity or expression, genetic information, military or veteran status, or any other characteristic protected by applicable law. We are committed to building a team that reflects the patients we serve. We actively encourage applications from candidates of all backgrounds. If you require accommodations during the hiring process, please contact people@hippocraticai.com . Please be aware of recruitment scams impersonating Hippocratic AI. All recruiting communication will come from @ hippocraticai.com email addresses. We will never request payment or sensitive personal information during the hiring process. Please mention the word **SPRIGHTLY** and tag RNDMuMjU1LjEyMi40Mw== when applying to show you read the job post completely (#RNDMuMjU1LjEyMi40Mw==). This is a beta feature to avoid spam applicants. Companies can search these words to find applicants that read this and see they're human.

🇨🇳 全文翻译

职位 我们已发展到约 265 人在 Menlo Park 总部现场办公,并由庞大的美国持证远程临床医生网络提供支持——C 轮融资的一部分已指定用于收购。支撑这一切的系统和空间原本是为规模小得多的公司搭建的。我们正在招聘一名 IT 与办公场所总监,来妥善掌管这些事务。你将负责同一问题的两个方面:员工技术平台——身份、终端、网络、SaaS 组合以及我们的 IT 安全态势——以及公司运营所依赖的物理环境,从空间规划和物理安全,到客户演示和全员大会所依赖的音视频(AV)。你将接手一支小而精干的团队,并负责提升团队水平。你将成为我们 HIPAA 和 SOC 2 项目中 IT 控制的具名负责人,负责 IT 与办公场所预算,并且当我们收购一家公司时,你将负责其整合。 我们的环境 身份与访问:使用 Okta 实现 SSO、MFA 和生命周期配置。生产力工具:Microsoft 365 和 Google Workspace,二者在全公司范围内均在积极使用。终端:以 Mac 为主的设备群,同时配有 Windows 机器,通过 MDM 管理。包括 VDI。内部系统:IRU,以及不断增长的内部和第三方 SaaS 应用组合。办公场所:位于 Palo Alto 的总部,配有会议室 AV 和门禁控制,以及分布式的临床医生和员工群体。 你将做什么 战略、预算和团队 负责与招聘计划挂钩的多年期 IT 与办公场所路线图,并带着明确的权衡和资金需求向管理层汇报。负责 IT 与办公场所的运营和资本预算:进行预测,在规划周期中为其辩护,并持续优化许可证、供应商和设施支出。领导、辅导并发展现有团队——设定明确期望,进行坦诚的绩效对话,随着职责范围扩大而招聘,并建立能留住优秀人才的职业发展路径。定义并发布工单响应、正常运行时间、入职就绪度和办公场所处理时效的服务水平,并向高管团队汇报这些指标的达成情况。 技术与基础设施 负责身份平台:SSO、MFA、Okta 中的自动化入职-转岗-离职(joiner-mover-leaver)配置,以及所有已连接应用的访问治理。负责终端设备群和 SaaS 组合——Microsoft 365、Google Workspace、IRU 以及大量长尾业务应用——并强制执行针对加密、补丁和配置的 MDM 基线。负责总部和远程员工队伍的网络与连接,并具备与客户所依赖的公司相匹配的冗余。用脚本化、可审计的工作流取代手动配置、访问审查和设备设置。端到端领导重大项目:平台迁移、升级、办公室建设,以及被收购公司的 IT 与办公场所整合。 安全、合规和风险 作为我们 HIPAA、SOC 2 和客户安全审查项目中 IT 控制的问责负责人,包括证据收集和审计响应。在整个环境中强制执行最小权限,并定期开展访问认证,记录结果。与安全团队合作处理事件响应和漏洞修复,与法务团队合作处理数据处理、保留和证据开示请求。负责公司系统的业务连续性和灾难恢复——编写计划、测试计划,并修复测试暴露的问题。以客户及其患者期望的谨慎态度对待受保护的健康信息和机密数据。这是我们一切工作中不可妥协的原则。 办公场所与设施 负责总部的日常运营,并依据不断变化的招聘计划领导空间规划和建设。管理物理安全——门禁控制和证件、访客管理、摄像头和应急准备——并符合我们的合规义务。负责会议室和活动 AV,包括全员大会和客户来访,达到技术永远不会成为问题焦点的标准。为远程临床医生和员工提供支持,确保可靠的设备物流、家庭办公标准,以及无论地点如何都一致的服务。与财务和法务合作,管理设施、AV、安全和餐饮供应商,以及房东和租赁事宜。 你将带来什么 8 年以上 IT 经验,涵盖实操型管理或工程

🔍 深度分析

---

Hippocratic AI《Director of IT and Workplace》JD 深度分析报告

> 服务对象:12 年安全经验、现任/曾任安全负责人(总监级,带团队、管预算、双体系认证)的求职者

> 目标岗位:安全总监 / 安全经理 / 安全工程师 / 安全架构师

> 本报告严格基于 JD 原文,所有结论标注依据;行业判断标注「基于行业常识」或「推断」。

---

0. 背景科普(给非本领域读者)

0.1 技术名词解释表(JD 出现的每个关键术语,一个不漏)

术语一句话通俗解释为什么这个岗位要它
**HIPAA**美国《健康保险流通与责任法案》,规定医疗健康数据(PHI)怎么存、怎么传、谁能看,违规罚款极重JD 原文「named owner for IT controls in our HIPAA and SOC 2 programs」——公司做医疗 AI,处理病人数据,必须有专人当"合规责任人",出了事这个人背锅
**SOC 2**一套由独立审计师出具的"安全信任报告",证明公司对客户数据的管理达到行业标准(分 Type I/II)原文「customer security review programs」——B 端客户(医院)采购前会要这份报告,没有就丢单
**HITRUST**比 SOC 2 更严的医疗行业安全认证框架,把 HIPAA 等要求打包成可审计的控件集原文「HIPAA, SOC 2, or HITRUST」——医疗客户常直接要求 HITRUST 认证
**PHI(Protected Health Information)**受保护的健康信息,即任何能关联到具体病人的医疗数据原文「Treat protected health information... with the care our customers and their patients expect. This is non-negotiable」——这是公司生意的命根子
**Okta**一家做"身份登录"的 SaaS 公司,员工用一个账号登录所有系统(SSO),并管多因素认证(MFA)和入职/离职自动开停账号原文「Okta for SSO, MFA, and lifecycle provisioning」——身份是 IT 安全的第一道门,也是审计重点
**SSO(Single Sign-On)**单点登录,一次登录通行所有系统同上,减少密码泄露面、便于统一管控
**MFA(Multi-Factor Authentication)**多因素认证,登录除密码外还要手机验证码/硬件密钥等第二因子同上,防账号被盗
**Lifecycle provisioning / joiner-mover-leaver**员工入职(joiner)自动开账号、转岗(mover)调权限、离职(leaver)自动关账号的自动化流程原文「automated joiner-mover-leaver provisioning」——离职没关账号是审计高频扣分项
**Access governance / access certification**权限治理:定期复查"谁有什么权限、还该不该有",并留证据原文「run recurring access certifications with documented outcomes」——SOC 2 审计必查
**Least privilege**最小权限原则:只给干活必需的最小权限原文「Enforce least privilege across the environment」——安全基线要求
**Microsoft 365 / Google Workspace**微软和谷歌的两套办公套件(邮箱、文档、会议等)原文「both in active use」——公司两套并用,意味着集成和治理复杂度翻倍(推断:历史遗留或并购导致)
**MDM(Mobile Device Management)**移动设备管理,统一管控公司电脑/手机的加密、补丁、配置原文「managed through MDM」「enforced MDM baselines for encryption, patching, and configuration」——终端是攻击入口,也是审计证据来源
**Mac-primary fleet / Windows alongside**以 Mac 为主、Windows 并存的终端设备群原文——双平台运维,Jamf(Mac 管理工具)因此成为加分认证
**VDI(Virtual Desktop Infrastructure)**虚拟桌面,把桌面跑在服务器上,员工远程连过去用原文「VDIs included」——远程/外包人员常用,安全隔离手段
**IRU**JD 未解释的内部系统缩写(推断为某内部运营/排班/临床管理系统)原文「Internal systems: IRU」——需要接手并治理的内部应用
**SaaS portfolio**公司采购的一堆云软件(几十上百个),每个都要管账号、合同、安全原文「a long tail of business applications」——SaaS 泛滥是成本和攻击面双重大坑
**IaC(Infrastructure as Code)**基础设施即代码,用脚本/配置文件而不是手工点鼠标来部署和管理服务器、设备原文 nice-to-have「managing devices and infrastructure as code」——规模化后手工运维不可持续
**SBOM**软件物料清单,列出软件里用了哪些开源组件,便于漏洞追溯⚠️ **JD 原文未出现 SBOM**,本报告不虚构;此处仅作对照说明,避免误读
**Zero Trust**零信任,不默认信任内网,每次访问都验证⚠️ **JD 原文未出现 Zero Trust**;JD 用「least privilege」「access governance」表达同类思想
**K8s(Kubernetes)**容器编排平台,管理大量容器化应用⚠️ **JD 原文未出现 K8s**;本岗位是 IT/办公 IT 线,不涉及云原生平台工程
**STIG**美国国防部安全技术实施指南(系统加固基线)⚠️ **JD 原文未出现 STIG**;本岗位不涉及政府/国防合规
**ATO(Authority to Operate)**美国政府系统上线授权⚠️ **JD 原文未出现 ATO**;本岗位不涉及 FedRAMP 类政府合规
**RLS(Row-Level Security)**数据库行级安全,按行控制谁能看⚠️ **JD 原文未出现 RLS**;属数据平台范畴,非本岗
**Business continuity / DR(BC/DR)**业务连续性与灾难恢复:系统挂了怎么快速恢复,计划要写、要演练原文「Own business continuity and disaster recovery for corporate systems — write the plans, test them」——客户依赖公司服务,宕机=事故
**Incident response(IR)**安全事件响应:被攻击/泄露后怎么处置原文「Partner with Security on incident response」——注意是"配合 Security",说明安全团队另有其人
**Vulnerability remediation**漏洞修复:发现漏洞后打补丁/缓解同上,本岗是配合方而非主导方
**Data retention / discovery requests**数据保留政策与(诉讼/监管)取证请求原文「with Legal on data handling, retention, and discovery requests」——法务协作
**AV(Audio-Visual)**音视频系统:会议室投屏、视频会议、直播原文「conference room AV」「all-hands and customer visits」——客户演示和全员会靠它,坏了很丢人
**Access control / badging / visitor management**物理门禁:刷卡、访客登记、摄像头原文「physical security — access control and badging, visitor management, cameras」——物理安全也是合规一部分
**Space planning / buildouts / lease management**办公空间规划、装修扩建、租约管理原文——公司扩张要扩办公室,这是"办公 IT 总监"的另一半
**Series C**C 轮融资,公司成长期的重要一轮原文「$126M Series C at a $3.5B valuation」——有钱扩张,所以现在招人
**CISM / CISSP**国际认可的安全管理(CISM)/安全专家(CISSP)认证原文 nice-to-have——证明安全治理能力
**ITIL**IT 服务管理最佳实践框架(工单、SLA、变更管理)原文 nice-to-have——本岗要定 SLA、管工单
**Jamf**Mac 设备管理的主流工具原文 nice-to-have——对应「Mac-primary fleet」
**Okta Certified Administrator / Microsoft 365 Enterprise Administrator**Okta 和微软的管理员认证原文 nice-to-have——对应两大核心平台
**SLA(Service Level Agreement)**服务水平协议:承诺工单多久响应、系统多高可用原文「Define and publish service levels for ticket response, uptime, onboarding readiness」——要向高管汇报达成率
**Capex / Opex(operating and capital budget)**运营支出(订阅、人力)与资本支出(设备、装修)原文「operating and capital budget」——要会做预算、扛预算
**Redundancy**冗余:网络/系统做备份线路,坏一条还有一条原文「with redundancy appropriate to a company our customers depend on」——客户依赖,不能断网

> **给读者的关键提醒**:这份 JD 里**没有** STIG / ATO / RLS / SBOM / Zero Trust / K8s。这些是安全工程/云原生/政府合规线的词,与本岗位(企业 IT + 办公场所 + 合规控制人)不是同一条线。求职者若拿这些词硬套,会在面试中暴露"没读懂岗位"。

0.2 公司赛道科普

0.3 这个岗位为什么存在

---

1. 岗位速览

**一句话**:这是一个"**企业 IT + 办公场所 + 合规控制人**"三合一的总监岗——管员工用的电脑/账号/网络/办公软件(IT),管办公室装修/门禁/会议室音视频(Workplace),并作为 HIPAA/SOC 2 审计中 IT 控制的**具名责任人**(Compliance)。

**属于安全哪条线**:

> **对求职者的关键判断**:这不是"安全总监/CISO"岗,而是"**IT 总监 + 合规控制人 + 设施**"岗。安全只占其中一部分(合规证据、最小权限、访问认证、BC/DR)。求职者若以"安全负责人"身份硬投,需要**重新定位叙事**(见第 7、10 节)。

---

2. 公司画像

2.1 公司做什么、规模阶段

2.2 为什么现在招这个人(从措辞推断,标注"推断")

2.3 市场发展(基于行业常识,标注)

---

3. 职责拆解(逐条:中文翻译 + 点评)

> 原文分四块:Strategy/budget/team、Technology/infrastructure、Security/compliance/risk、Workplace/facilities。逐条拆。

A. 战略、预算、团队

#原文中文翻译点评(什么活/含金量/占比推断)
A1Own a multi-year IT and workplace roadmap tied to the hiring plan, and bring it to leadership with clear tradeoffs and funding asks制定多年期 IT 与办公场所路线图,绑定招聘计划,向管理层讲清取舍并要预算**高含金量**:战略+向上管理。占比 ~10%。考验"把技术翻译成钱和风险"的能力
A2Own the IT and workplace operating and capital budget: forecast it, defend it in planning cycles, and continuously rationalize license, vendor, and facilities spend管 IT 与办公的运营+资本预算:预测、在规划周期里辩护、持续优化 license/供应商/设施开支**高含金量**:真金白银的预算权。占比 ~10%。"rationalize spend"=砍冗余 SaaS,是硬指标
A3Lead, coach, and grow the existing team — set clear expectations, run honest performance conversations, hire as scope deepens, and build career paths带团队:定预期、做绩效对话、按需招聘、建职业路径**中高含金量**:真带队。占比 ~15%。"honest performance conversations"暗示团队里可能有需要处理的人(推断)
A4Define and publish service levels for ticket response, uptime, onboarding readiness, and workplace turnaround, and report against them to the executive team定义并公布 SLA(工单响应、可用率、入职就绪、办公周转),向高管汇报达成**中含金量**:ITIL 式服务管理。占比 ~5%。是"从人治到制度化"的标志

B. 技术与基础设施

#原文中文翻译点评
B1Own the identity platform: SSO, MFA, automated joiner-mover-leaver provisioning in Okta, and access governance across every connected application管身份平台:Okta 的 SSO/MFA/入转离自动化,以及所有接入应用的权限治理**高含金量+高安全相关**:身份是安全核心。占比 ~10%。直接对应审计证据
B2Own the endpoint fleet and the SaaS portfolio — Microsoft 365, Google Workspace, IRU, and a long tail of business applications — with enforced MDM baselines for encryption, patching, and configuration管终端和 SaaS 组合,强制 MDM 基线(加密/补丁/配置)**中高含金量**:终端安全+成本治理。占比 ~10%。"long tail"=SaaS 泛滥,是坑也是立功点
B3Own network and connectivity for the headquarters and the remote workforce, with redundancy appropriate to a company our customers depend on管总部与远程的网络连接,做适当冗余**中含金量**:网络运维。占比 ~5%。"customers depend on"=不能断,压力大
B4Replace manual provisioning, access reviews, and device setup with scripted, auditable workflows用手册化/可审计的自动化替代手工开户、权限复查、设备配置**高含金量**:自动化是"从救火到体系"的关键。占比 ~10%。对应 nice-to-have 的 Python/Bash/PowerShell
B5Lead major programs end to end: platform migrations, upgrades, office buildouts, and the IT and workplace integration of acquired companies端到端lead大项目:平台迁移、升级、办公室建设、被收购公司的 IT/办公整合**高含金量**:项目管理+并购整合。占比 ~10%。并购整合是稀缺经验

C. 安全、合规、风险

#原文中文翻译点评
C1Serve as the accountable owner for IT controls in our HIPAA, SOC 2, and customer security review programs, including evidence collection and audit response作为 HIPAA/SOC 2/客户安全审查中 IT 控制的**具名责任人**,含证据收集与审计应答**最高含金量+最核心**:这是岗位存在的根本理由。占比 ~15%。"accountable"=出事你背
C2Enforce least privilege across the environment and run recurring access certifications with documented outcomes全环境最小权限,定期权限认证并留档**高含金量**:安全治理基本功。占比 ~5%。审计必查
C3Partner with Security on incident response and vulnerability remediation, and with Legal on data handling, retention, and discovery requests配合安全团队做事件响应/漏洞修复,配合法务做数据处理/保留/取证**中含金量**:**配合方**,非主导。占比 ~5%。说明安全团队另有其人,本岗不是 CISO
C4Own business continuity and disaster recovery for corporate systems — write the plans, test them, and fix what the tests expose管企业系统 BC/DR:写计划、演练、修复暴露的问题**高含金量**:合规+可靠性双重要求。占比 ~5%。"test them"=不能只写不练
C5Treat protected health information and confidential data with the care our customers and their patients expect. This is non-negotiable以客户和病人期待的标准对待 PHI 和机密数据,**不可妥协****价值观红线**:面试必考。占比贯穿全程

D. 办公场所与设施

#原文中文翻译点评
D1Own day-to-day operations of the headquarters, and lead space planning and buildouts against a hiring plan that keeps moving管总部日常运营,按不断变化的招聘计划做空间规划和建设**中含金量**:设施运营。占比 ~10%。"keeps moving"=计划老变,累
D2Manage physical security — access control and badging, visitor management, cameras, and emergency preparedness — aligned with our compliance obligations管物理安全:门禁/工牌/访客/摄像头/应急,对齐合规**中含金量+安全相关**:物理安全也是合规一部分。占比 ~5%
D3Own conference room and event AV, including all-hands and customer visits, to a standard where the technology is never the story管会议室和活动音视频,标准是"技术永远不成为话题"(即不能出岔子)**低含金量但高曝光**:做好了没人夸,坏了全公司骂。占比 ~5%
D4Support remote clinicians and staff with reliable equipment logistics, home office standards, and consistent service regardless of location支持远程临床人员和员工:设备物流、居家办公标准、一致服务**中含金量**:远程支持规模化。占比 ~5%。远程临床人员是公司核心运力,不能掉链子
D5Manage facilities, AV, security, and food vendors, plus landlord and lease matters, in partnership with Finance and Legal管设施/AV/安保/餐饮供应商,以及房东和租约,配合财务法务**中含金量**:供应商+租约管理。占比 ~5%。"food vendors"=连食堂都管,典型"办公 IT 总监"

> **职责总评**:安全/合规约占 **35-40%**(C 块 + B1/B2 的安全部分),IT 工程运营约 **35%**,设施/办公约 **25%**。这是一个**"IT 总监为主、合规控制人为魂、设施为副"**的复合岗。

---

4. 要求清单(三档)

4.1 硬门槛(没有就没戏)

#原文解读
H1「8+ years in IT, spanning hands-on administration or engineering and progressively senior ownership」8 年以上 IT 经验,且**既做过动手的运维/工程,又做过越来越高的负责人**。纯安全背景、没做过 IT 运维的,这里会卡
H2「3+ years managing IT or workplace teams, including hiring, performance management, and developing people」3 年以上**带 IT/办公团队**(不是带安全团队),含招聘、绩效、培养
H3「Proven ownership of an IT function through rapid growth. You've scaled systems and process ahead of headcount」在**快速扩张期**当过 IT 负责人,且是"系统跑在人头前面"而非追着补
H4「Deep technical expertise across identity (Okta or comparable), Microsoft 365 and Google Workspace, MDM at fleet scale, and corporate networking」身份(Okta 或同类)+ M365 + Google Workspace + 大规模 MDM + 企业网络,**深度** expertise
H5「Experience as a named control owner in a regulated environment — HIPAA, SOC 2, or HITRUST — including sitting across the table from auditors」**具名**当过受监管环境的控制责任人,且**面对面应对过审计师**。这是最硬的一条
H6「Budget ownership and vendor negotiation experience, with the financial fluency to frame a risk or a funding ask so a CFO can act on it」管过预算、谈过供应商,能把风险/要钱讲成 CFO 能决策的话
H7「Workplace or facilities exposure — buildouts, moves, physical security, or lease management — or a genuine appetite to own it and learn quickly」有设施经验**或**真心愿意学(这条留了口子,非绝对硬)
H8「Willingness to stay close to the work... the director still unblocks a broken demo when it matters」愿意亲自下场救火,不是甩手掌柜
H9「Bachelor's degree in IT, CS, or related, or equivalent experience. We weigh demonstrated ability over credentials」学历可被经验替代,**实际是软门槛**

4.2 加分项(Nice to Have,原文明确列出)

#原文解读
N1「Healthcare, life sciences, or another environment handling sensitive personal data at scale」医疗/生命科学/大规模敏感数据行业背景
N2「IT integration of an acquisition, or standing up a function's first access governance or asset management program」并购 IT 整合经验,或**从 0 建**权限治理/资产管理体系
N3「Automation depth (Python, Bash, PowerShell) and experience managing devices and infrastructure as code」自动化脚本 + IaC 管设备/基础设施
N4「Certifications such as Okta Certified Administrator, Microsoft 365 Enterprise Administrator, Jamf, CISM, CISSP, or ITIL」具体认证清单(注意:CISSP/CISM 只是"之一",不是核心)

4.3 弹性要求(措辞留有余地)

#原文弹性点
F1「Okta **or comparable**」没用过 Okta,用过 Azure AD/OneLogin 等同类可替代
F2「or a genuine appetite to own it and learn quickly」(设施)没设施经验可用"学习意愿"补
F3「or equivalent experience」(学历)学历可被经验替代
F4「We weigh demonstrated ability over credentials」认证非硬性
F5「Nice to Have」整段加分项非必需

> **对求职者的关键提醒**:H1(8 年 IT 含动手运维)、H2(3 年带 IT 团队)、H5(具名控制人+面对审计师)是**三条最硬的坎**。求职者 12 年安全经验、带过团队、管过预算、双体系认证——**H5 大概率能打,H2 需确认带的是不是 IT 团队,H1 的"动手 IT 运维"是最大疑点**(安全负责人通常不亲自管 Okta/MDM/网络)。

---

5. 薪资分析

- 硅谷 Series C、$3.5B 估值公司、265 人规模的 **Director of IT**,总包(base + bonus + equity)大致在 **$220K–$320K/年**区间;若含设施职责(Workplace),偏上限。

- 折人民币(按 1 USD ≈ 7.2 CNY 粗算):**约 ¥158 万–¥230 万/年**,月均约 **¥13 万–¥19 万**。

- **对比同类岗位**:纯安全总监(CISO 线)在同等公司约 $250K–$400K;纯 IT 总监约 $200K–$280K。本岗是"IT+设施+合规"复合,**定位中高,但低于纯 CISO**——因为安全只是其中一块(原文「Partner with Security」说明安全另有负责人)。

- **判断:市场中位偏上**。理由:估值高、融资足、硅谷区位;但职责偏"后勤+合规",非核心安全线,溢价有限。

> **注意**:JD 未给区间,以上为行业推算,**投递前应主动问 recruiter 要 range**(加州法律要求雇主应要求提供薪资区间,基于行业常识)。

---

6. 签证与身份

逐条分析 JD 中与身份相关的信号:

维度JD 原文/信号分析
**Sponsorship(工签担保)**JD **未提及** sponsorship,也未说"must be authorized to work"**中性偏黄**。硅谷成长期公司常可 sponsor,但 JD 不写=不确定,需主动问
**Clearance(安全许可)****未出现** clearance/clearance-required 字样**绿灯**:非政府/国防岗,不需要 clearance
**Right-to-work(工作权)**未明确要求"U.S. person"或"authorized to work without sponsorship"**黄灯**:未排除,但也未承诺。医疗数据岗有时因合规要求限制,需确认
**远程限制**原文「265 people working onsite from our Menlo Park headquarters」「Own day-to-day operations of the headquarters」**红灯(对纯远程)**:这是**现场岗**,要管总部日常、门禁、AV、装修,**不可能纯远程**。平台标 remoteok 与 JD 矛盾,以 JD 为准
**海外求职意愿**岗位在美国硅谷,需现场**红灯(对中国境内直接入职)**:需美国工作身份+ relocation

**结论:中国人可投性 = 🟡 黄灯(有条件)**

打开原始链接 →