This is where most founders stall, and the reason is arithmetic.
A full-time senior IT lead at 35 people is a significant salary for a role that, once built properly, is genuinely part time. Founders sense that mismatch. So the decision gets deferred, and the work keeps spreading sideways.
But the choice is not between a full-time hire and nothing.
The build phase is real work: standardising the device fleet, consolidating identity, enforcing SSO, writing and automating joiner and leaver processes, producing an accurate app and access inventory. Call it a focused engagement measured in weeks.
The run phase, once that is done, is genuinely a few days a month. Access reviews, onboarding and offboarding, fleet health, vendor and renewal management, security questionnaires as they arrive.
That shape suits fractional or part-time senior ownership far better than a full-time hire. You get someone who has built this before, at the point where design decisions are cheap to make and expensive to reverse, without carrying a salary the role does not justify yet.
The failure mode to avoid is the opposite one: hiring a junior IT person to own architecture decisions they have not made before. They will do a good job on requests and an uncertain job on the identity and device foundations everything else sits on.