Endpoint Engineer

About the role

We're hiring an Endpoint Engineer to own how our devices are enrolled, configured, secured, patched, and retired. You'll run Microsoft Intune for Windows, Kandji with Apple Business Manager for Macs, and Entra ID Conditional Access to tie device trust to access. Jamf Pro experience transfers well. Much of the work is hands-on Intune delivery: migrating legacy Group Policy to cloud-native configuration, packaging and deploying apps (Win32, MSI, PKG), keeping third-party apps current, and remediating vulnerabilities across the fleet. Everything you ship is automated, version-controlled, and reproducible, using PowerShell, Python, Microsoft Graph, and Git-based pipelines. You'll work closely with our security and identity teams to define how corporate and BYOD devices prove compliance and earn access to company resources.

Responsibilities

• Own end-to-end Intune administration: compliance policies, configuration profiles, app deployment, Autopilot/Windows enrollment, Scope Tags, and RBAC design across business units.
• Manage Apple device lifecycle via Kandji + Apple Business Manager (ABM): DEP enrollment, supervised device policies, app deployment, and zero-touch provisioning.
• Design and enforce Conditional Access policies in Entra ID (device compliance, location, risk-based sign-in, session controls) in coordination with security/identity teams.
• Work with Endpoint engineering team on migration of legacy Group Policy Objects (GPOs) to Intune/Entra-based configuration and compliance policies, including translating GPO logic 1:1 where needed and documenting gaps.
• Build and maintain RBAC models across Intune, Entra ID, and Kandji.
• Develop automation/scripting for endpoint and identity workflows (PowerShell, Python, Microsoft Graph API).
• Implement and maintain MDM solutions for BYOD devices for Windows/Mac/Linux/Android devices.

Requirements

• 2+ years in systems/endpoint engineering, including hands-on administration of modern MDM (Intune, plus Kandji or Jamf Pro).
• Deep, hands-on Microsoft Intune expertise: compliance policies, configuration profiles, app protection/app config policies, Autopilot, Scope Tags, RBAC (built-in and custom roles).
• Kandji or Jamf Pro administration (Blueprints/policies, Library Items/config profiles, Liftoff or equivalent zero-touch enrollment).
• Apple Business Manager (ABM): DEP, VPP, device assignment, MDM server integration.
• Hands-on Group Policy (GPO) experience and proven experience migrating GPO logic to cloud-native MDM/compliance policy equivalents.
• Entra ID (Azure AD) administration: users/groups, dynamic groups, app registrations, enterprise apps, hybrid identity.
• Conditional Access policy design and troubleshooting (sign-in logs, what-if tool, break-glass account practices).
• Scripting proficiency: PowerShell, Python, Shell, Microsoft Graph API.
• Solid understanding of Windows and macOS device architecture, authentication protocols (Kerberos, SAML, OAuth/OIDC), and certificate-based auth (SCEP/PKCS).
• Strong documentation habits and ability to communicate technical tradeoffs to both engineering and non-technical stakeholders.
• Linux and macOS administration— command-line fluency, shell scripting, and system-level troubleshooting beyond GUI-based management.

Preferred qualifications

• Microsoft certifications (MS-102 Endpoint Administrator, SC-300 Identity and Access Administrator, AZ-500).
• Apple certifications (Apple Certified Support Professional / Apple Deployment and Management).
• Experience with Okta or other third-party IdPs alongside Entra ID.
• Experience with security frameworks/benchmarks (CIS, NIST) as applied to endpoint compliance baselines.
• ServiceNow or similar ITSM tooling for change management and automation triggers.

Benefits

• Healthcare benefits (medical, dental, vision, EAP)
• Competitive PTO
• 401k match
• Parental leave
• HSA contribution match
• Paid subscription to the Calm app
• Generous external learning and tuition reimbursement benefits
• Hybrid work schedule (flexibility of working from home and one of our primary offices)