Secure Access Setup for Google Workspace, QuickBooks Online & Dext

Overview

We are a professional accounting firm looking to engage an experienced IT security / identity management consultant to design and implement a secure, centralized access control setup for our core business applications.

The goal is to ensure that only authorized users can log in, and only from approved locations or networks, while still allowing secure remote work.

Objectives

The consultant will design and implement a solution that:

Restricts access to Google Workspace based on approved IP address(es)
Secures QuickBooks Online (QBO) and Dext using centralized authentication (SSO)
Provides a secure method (VPN or Zero Trust) for remote staff to access systems
Uses industry best practices (identity-first security, MFA, least privilege)
Avoids user lock-outs and includes a safe rollout plan

Scope of Work
1. Identity & Access Management

Review current Google Workspace setup
Configure advanced access controls (e.g. Context-Aware Access or equivalent)

Enforce:

IP-based restrictions
MFA
Role-based access (admins vs staff)
Ensure admin console access is tightly secured

2. Secure Remote Access

Design and implement one of the following (consultant recommendation expected):
Business-grade VPN with static outbound IP
Zero Trust solution (e.g. Cloudflare Zero Trust, Tailscale, etc.)
Ensure:

Predictable outbound IP for allow-listing
Centralized enforcement (users cannot bypass)
Easy onboarding for staff

3. Application Integration

Configure Single Sign-On (SSO) where supported:
Google Workspace
QuickBooks Online
Dext
Ensure login to QBO and Dext is effectively gated by Google authentication
Identify and mitigate any login bypass paths

4. Testing & Validation

Test access from:

Approved IP / network
Non-approved IP
VPN / remote setup

Confirm:

Unauthorized access is blocked
Authorized users can work without friction
Perform lock-out prevention checks

5. Documentation & Handover

Provide clear documentation including:
Architecture overview
How access is enforced
How to onboard/offboard users
Emergency admin access procedures
Short walkthrough session (live or recorded)

Deliverables

Fully configured secure access setup
Working VPN or Zero Trust solution
SSO integrated for required applications
Tested and validated security controls
Written documentation + handover

Required Experience

Google Workspace administration (Business Plus / Enterprise)

Identity & Access Management (IAM / SSO)

VPN or Zero Trust network implementations

SaaS security (QuickBooks Online, accounting systems preferred)

Strong understanding of MFA, IP allow-listing, and access policies

Nice to Have

Cloudflare Zero Trust experience

Tailscale or WireGuard experience

Accounting firm or financial services background

Security certifications (Google, Azure, AWS, CISSP, etc.)

Engagement Type

Fixed-scope project or hourly (with cap)

Remote work acceptable

Ongoing support optional (not required)

Success Criteria

Users cannot access systems from unapproved locations

Remote access works securely and reliably

No shared passwords

Clear audit trail and admin visibility

Minimal friction for day-to-day staff usage

To Apply

Please include:

Relevant experience with similar setups

Recommended technical approach

Estimated timeline

Estimated cost

Any risks or assumptions you see