Mac Device Management (Kandji IRU) and Automation Engineer

Full-time Hiring Now
  • Location: Remote — Available to work during US Hours (8:00 AM PST to 6:00 PM PST or India Hours (8:00 am IST to 6:00 pm IST)
  • Experience Level: Senior / Lead
  • Work Type: Full-Time

Company

Our client provides real-time measurement and intelligence for streaming media. The company also manages endpoint security and IT operations across global teams, with an emphasis on audit readiness.

###About the Role Own the Kandji (now Iru) platform end to end as a hands-on Apple and Windows endpoint management engineer. You’ll manage devices day to day and automate how they’re deployed, patched, secured and kept compliant—from zero-touch new-hire setup to policy controls and an accurate, audit-ready inventory. This is a device management engineering role, not a helpdesk or IT support role.

What you’ll do:Device

Device Enrollment and Lifecycle

  • Own zero-touch deployment through Apple Business Manager (ABM) and Automated Device Enrollment (ADE).
  • Design and maintain the new-hire setup experience, from opening the box to a fully configured, secure device.
  • Automate and Manage the full device lifecycle: purchase, enrollment, reassignment, repair, offboarding, laptop operations, secure wipe and retirement.

Blueprints and Configuration

  • Design and maintain blueprints (device configuration templates) by role, department and device type.
  • Build and manage configuration profiles, custom profiles and library items.
  • Standardize settings for Wi-Fi, VPN, certificates, privacy permissions (PPPC/TCC), system extensions and login items.
  • Review blueprints regularly. Consolidate duplicates and remove unused library items.

App Management

  • Automate, Deploy and update apps through Auto Apps, the App Store (VPP) and custom app packages.
  • Maintain a curated Self Service catalog with clear categories.
  • Keep an app inventory. Find unapproved or vulnerable software and remove it.
  • Package, script and test custom apps before they go out widely.
  • Keep third-party apps patched automatically and track exceptions.

Patching and OS Updates

  • Own macOS, Windows OS and iOS update enforcement, with clear deadlines and user communication. -Test new macOS and iOS releases before they reach the company.

Security and Compliance

  • Enforce FileVault encryption, escrow recovery keys, and control who can retrieve them.
  • Manage Gatekeeper, XProtect, the firewall, screen lock and password policies.
  • Manage local admin rights, including temporary admin access where needed.
  • Map device controls to CIS benchmarks and compliance templates.
  • Manage Kandji EDR, threat detections and vulnerability management, and work with Security on fixes.
  • Provide device evidence for SOC 2, ISO 27001 and internal audits.

Identity Integration

  • Integrate Kandji with Okta for user sync, automatic device assignment and SSO.
  • Set up Okta Device Trust and device assurance so only managed, compliant devices can reach company apps.
  • Set up Kandji Passport (Mac sign-in with Okta) for password sync on Macs.
  • Keep device-to-user assignments accurate as people join, move teams or leave.

Automation and Scripting

  • Write and maintain scripts in Bash, Zsh and Python for fixes, audits and device checks. -Use the Kandji API for bulk tasks, reporting and integrations.
  • Connect Kandji with Jira, Slack and Okta Workflows for alerts, tickets and offboarding steps.

Inventory, Reporting and Hygiene -Keep a complete, accurate device inventory in Snipe IT: owner, location, model, warranty and status.

  • Find and clean up stale, unassigned, duplicate or offline devices. -Track warranty, AppleCare and refresh cycles, and plan hardware replacements. -Report regularly on compliance, patch status, encryption and security posture.

Operations and Support

  • Act as the escalation point for enrollment, profile, app and device problems.
  • Write and maintain runbooks, SOPs and helpdesk guides.
  • Train the IT helpdesk on Kandji procedures.
  • Evaluate new Kandji features and Apple platform changes, and plan how to adopt them.
  • Experience working in a SOC 2 or ISO 27001 environment. -Some Windows device management experience, for mixed-device environments.

###Your background and skills will include:

  • 7+ years managing Apple devices primarily with Kandji (or Jamf)
  • Deep experience with macOS and Windows OS configuration profiles, system extensions, Chrome Profile Management and FileVault.
  • Automation / Scripting in Bash/Zsh, with Python as a plus. Experience with the Kandji API ,
  • Experience packaging and deploying macOS 3rd party apps.
  • Experience with other MDMs (Jamf) can be considered.
  • Certifications: Kandji Certified Administrator OR/ JAMF 300 Certified Administrator
  • Experience integrating Okta with an MDM, including Device Trust and Kandji Passport.
  • Experience working with Inventory Management

###These are big plus:

  • Experience working with Model Context Protocol and building AI Agents for automating operations.
  • Experience working in a SOC 2 or ISO 27001 environment.
  • Code42 for backups, Crowdstrike for AV
  • Terraform experience
  • Familiarity with Google Workspace, Slack, Okta integrations.