Google Workspace Administrator

Location: Hybrid —Washington, DCPeriod of Performance: 12+ Months Contract Clearance: Public Trust suitability + OPM FBI fingerprint criminal background check with financial/credit review; re-screened annually

Role Summary: As an US Citizen, you gace to work as a Google Workspace Administrator, who will be the single dedicated full-time resource responsible for administering, governing, and optimizing USHMM's entire Google Workspace tenant. This person is the primary point of contact for all Workspace-related activity — configuring the platform to meet business, security, and compliance requirements, and providing technical training and documentation to the Museum's existing team of roughly 6–8 Google administrators. This is a senior individual-contributor role: the person owns the environment end to end and works across all support tiers depending on the problem, not just Tier 3.Environment You'll Be Administering This is a large, mature enterprise tenant — not a small shop. Scope includes:~902 active users (925 provisioned), 22 organizational units, 653 groups 1,294 shared drives, 23.5 TB Drive storage, ~47 TB total footprint 908 Workspace licenses, 1,743 archived-user licenses, 26 Google Voice licenses 40 privileged administrators to coordinate with and govern 1 primary domain, 2 secondary domains/aliases Okta as the identity source of truth (SSO/MFA already in place)Service Now for ticketing, change, and incident workflow Jamf (Apple), Google MDM (mobile), Endpoint Central (everything else)Third-party CASB for DLP; Google Vault with indefinite retention Commercial Workspace tenant, with an active initiative to move toward FedRAMP Moderate

Core Responsibilities: Platform Administration & Account Management Administer all Workspace domains and services as primary owner Manage users, groups, OUs, and role-based access controls Own identity lifecycle: onboarding, role changes, offboarding Manage licensing, subscriptions, and cost/storage optimization (Drive storage and license right-sizing are named priorities)Core Service Management Administer and optimize Gmail, Drive, Docs/Sheets/Slides/Forms, Meet, Chat, and Calendar Stand up and support Gemini for Workspace and NotebookLM for internal Museum use Security & Access Controls Enforce MFA for all users, mandatory for privileged accounts Configure and maintain SSO/identity federation via Okta Enforce password, session-control, and device-trust policies Manage DLP, IRM, and secure-sharing controls in coordination with the CASBMonitor security alerts; respond to phishing, account compromise, and unauthorized access Compliance & Risk Management Maintain alignment with NIST CSF, NIST SP 800-53, and FISMASupport the migration toward FedRAMP Moderate consistent with Museum direction Maintain documentation and evidence supporting audits, assessments, and ATO activities Understand that federal PII is treated as CUI, with State Privacy Acts, PCI, and HIPAA also in scope, and NARA/M-19-21 records-management requirements in effect Operations & Maintenance Routine health checks, configuration reviews, and policy/feature updates Change management to minimize disruption; incident, outage, and escalation response After-hours/weekend response for critical or mission-critical outages (normal coverage is business hours)Planning & Optimization Lead strategic planning for Workspace adoption; maintain a continuous-improvement roadmap Evaluate new features for Museum applicability; recommend automation and UX improvements Stakeholder Coordination & Training Serve as liaison among Museum leadership, IT, program offices, and Google support Provide technical training and best-practice guidance to the Museum's Google administrators and broader community Deliverables the Person Owns Governance/administration documentation, security and access-control policies, NIST/FISMA/FedRAMP-aligned compliance documentation, operational runbooks and incident-response procedures, user lifecycle procedures, and monthly status reports.

Required Qualifications: Google Workspace Administrator Professional certification, current and in good standing — this is mandatory, not preferred. No exceptions; a candidate without it is non-compliant. Hands-on experience administering Google Workspace at large enterprise or federal/federal-adjacent scale (hundreds to ~1,000 users, complex OU/shared-drive structures)Strong identity management, MFA, and zero-trust fundamentals; direct Okta experience strongly desired Experience supporting NIST-, FISMA-, and FedRAMP-aligned environments Able to obtain Public Trust suitability and pass an OPM fingerprint criminal check with credit/financial reviewU.S. citizenship or work authorization; able to work onsite in Washington, DC on a hybrid schedule (~10 onsite days/month, five every two weeks)

Preferred Qualifications: Google Cloud Certified — Professional Cloud Security Engineer Google Cloud Certified — Professional Cloud Architect Service Now, Jamf, Endpoint Central, and CASB/DLP tooling familiarity Experience with Google Vault retention and NARA records-management requirements