NAME
ScottSchultz keeps identity, devices and audits boring, so the company can move fast.
Scott Schultz. IT & security leader with 20+ years in the job, currently IT Manager at Foodsmart. Based in the SF Bay Area. The personal page is separate from this manual.
SYNOPSIS
scott-schultz [--identity okta]
[--mdm kandji|jamf|intune|jumpcloud]
[--lifecycle joiner|mover|leaver]
[--audit soc2-type2|iso27001]
[--ai-rollout governed]DESCRIPTION
WHAT I WANT NEXT
I want a seat that owns internal IT and security as one system: who has access, which devices are trusted, how people join and leave, and the evidence when an auditor asks. The companies where that work goes well have outgrown shared logins, and they are not yet so large that IT is only a queue.
I want to stay close to the tools — Okta, the MDM, the lifecycle automation — and be accountable for the function around them. That includes rolling out AI with identity and policy already in place. A small team, or a solo role with room to automate, is a shape I know how to make quiet and reliable. I am based in the SF Bay Area.
Scott Schultz builds and runs the internal systems a company quietly depends on: who has access to what, which laptops are trusted, and the evidence that proves it when an auditor asks.
Over 20+ years in IT and security he has worked inside companies at very different stages, from Yelp and Mapbox to Amplitude, where he was Manager, Trust & Security through the company's IPO, including SOC 2 Type 2 and ISO 27001. Today he is IT Manager at Foodsmart, since March 2025, after joining as IT Support Engineer in August 2023. He holds a BA in Business Administration, Decision & Information Sciences, from the Warrington College of Business at the University of Florida.
The through-line is the same everywhere: make identity the source of truth, automate the employee lifecycle end to end, and treat compliance as a by-product of running things well, not a fire drill once a year.
WHAT I'VE BUILT
- Identity. Okta Identity Engine and IGA, SCIM, and 35+ integrations at Hired, with groups doing the provisioning. See
--identity. - Devices. Kandji, Jamf, Intune, and JumpCloud fleets with a baseline you can prove. See
--mdm. - Lifecycle. Joiner, mover, and leaver, including the access a role change is supposed to remove. See
--lifecycle. - Audits. SOC 2 Type 2 and ISO 27001, evidence included, not just the policy. See
--audit. - Governed AI. Shadow AI found, agent access decided, rollout logged. See
--ai-rollout. - Par4 and Par3. He runs Par4 Technologies, custom web design for small businesses, and Par3, a SaaS that turns ad-agency DSP and location exports into AI-written white-label client dashboards.
OPTIONS
The flags below are the work itself. Strengths, written the way a manual writes switches.
--identity okta- Deep Okta work: Identity Engine and Identity Governance (IGA), SCIM provisioning, and 35+ application integrations. Groups and rules do the provisioning, not tickets.
--mdm kandji|jamf|intune|jumpcloud- Device management across Mac and Windows fleets with Kandji, Jamf, Intune and JumpCloud: zero-touch enrollment, baselines, and a fleet you can actually prove is compliant.
--lifecycle joiner|mover|leaver- Employee-lifecycle automation. Onboarding that is ready before day one, role changes that remove old access as well as adding new, and offboarding that closes everything. Try it below ↓
--audit soc2-type2|iso27001- Hands-on experience with SOC 2 Type 2 and ISO 27001 audits: access reviews, evidence collection, and controls that hold up across the full audit window.
--ai-rollout governed- Secure, governed rollouts of AI assistants: find the shadow AI already in use, decide which agents get access to what, then roll out with identity, logging and policy in place. See SEE ALSO.
EXAMPLES
Run the lifecycle yourself. Pick an event and watch what a well-built identity and device stack does on its own: every account, group, device and piece of audit evidence.
run log
access diff
audit evidence
Illustrative example of how I design lifecycle automation. Generic app names; not a live system, nothing is sent anywhere.
PROCEDURE
How I would run your IT and security in the first 90 days. Select a phase.
- Meet the people who feel IT pain most: new hires, managers, finance, engineering leads.
- Inventory every app, every admin, every device. Find what isn't behind SSO yet.
- Map the current joiner, mover and leaver flow exactly as it happens today, including the manual bits.
- Walk the last audit's findings (or the gaps before a first one) with whoever owns compliance.
- Make the HR system the source of truth and identity the control plane. People records drive accounts, not tickets.
- Define birthright access by department and role. Everything else is requested, approved and logged.
- Get every laptop into MDM with a real baseline: encryption, updates, screen lock, endpoint protection.
- Close the obvious doors first: shared admin accounts, stale users, missing MFA.
- Automate provisioning with SCIM wherever the app supports it; script or workflow the rest.
- Ship offboarding that revokes sessions, reclaims licenses and secures the device the same day.
- Run the first quarterly access review, and keep its evidence where an auditor can find it.
- Put a policy and an approved path in place for AI assistants, so people stop pasting data into tools nobody approved.
BUGS
Known limitations. Stated in the first person, because they are mine.
- bug 1 · hands on the tenant I will happily stay in the Okta config, the MDM baseline, and the offboarding script myself. That is useful right up until a team needs the design more than it needs me in the console. I am working on handing off the runbook earlier.
- bug 2 · exceptions A one-off access grant feels small. I know they pile up into the finding at the end of an audit window. I still have to catch myself when a reasonable person asks for a reasonable shortcut.
- bug 3 · the room I can explain a control to another operator in a sentence. Explaining it to someone who wants the tool turned on today, without sounding like I only know how to say no, is the skill I am still sharpening. I will write the precise version afterward. I would rather have said it while everyone was still there.
HISTORY
-
2025
Foodsmart current
IT Manager · –Present. Built a two-person team for 800+ employees.
IT Support Engineer · –. Sole IT, onboarding 30+ hires a week.
-
2023
Verana Health
IT Manager · –.
-
2021
Amplitude
Manager, Trust & Security · –. Through the IPO. SOC 2 Type 2 and ISO 27001. Zero-touch onboarding with Okta and Kandji.
Sr. IT Engineer · –.
-
2017
Mapbox
IT Specialist · –.
-
2015
Hired
Sr. Manager, IT · –. 35+ Okta integrations. Office buildouts in SF, NYC, Toronto, and London.
-
2013
Turn
Desktop Support Engineer · –.
-
2010
Yelp
IT Engineer / IT Employee Relations Coordinator · –.
-
UF
University of Florida
BA, Business Administration, Decision & Information Sciences. Warrington College of Business.
SEE ALSO
The personal page, and the work outside the day job.
- scott-schultz(7) — the personal page. Not this manual.
- par4(7) — Par4 Technologies, at par4.io. Custom web design for small businesses.
- par3(7) — SaaS that turns ad-agency DSP and location exports into AI-written, white-label client dashboards.
- governed-ai(8) — Secure AI rollouts, offered through Par4:
auditShadow-AI and agent-access audit, $2,500.rolloutClaude, ChatGPT or Copilot rollout for up to 25 users, $6K.
AUTHOR
