- Location: Remote — Available to work during US Hours (8:00 AM PST to 6:00 PM PST)
- Experience Level: Senior / Lead
- Work Type: Full-Time
Company
Our client operates at the intersection of streaming media infrastructure and enterprise technology, providing a real-time measurement and intelligence platform for the industry. As the company supports seamless digital experiences across global teams, endpoint security and IT operations are a critical part of keeping the business secure, compliant, and running smoothly.
About the Role
This is a senior, hands-on Device Management Engineering role for someone who can own Apple and Windows endpoint management end to end, with Kandji at the center. You will lead how devices are deployed, secured, patched, and maintained across the company, with a strong emphasis on automation, compliance, and operational reliability.
The scope includes zero-touch provisioning for new hires, automated patching, policy enforcement, security controls, and maintaining an accurate, audit-ready device inventory. This role is designed for an experienced endpoint management professional who wants to combine day-to-day platform ownership with the opportunity to improve the systems, workflows, and standards behind device management. It is not a helpdesk or IT support role.
What you’ll do:Device
- Enrollment & Lifecycle: Own zero-touch deployment using Apple Business Manager (ABM) and Automated Device Enrollment (ADE). Automate the complete hardware lifecycle, including purchasing, enrollment, reassignments, repairs, offboarding, laptop wipes, and retirement.
- Blueprints & Configuration Management: Design and maintain device blueprints, configuration profiles, custom settings, and library items tailored by role, department, and device type. Standardize Wi-Fi, VPN, certificates, privacy permissions (PPPC/TCC), and login items while regularly consolidating redundant configurations.
- Application Lifecycle & Patching: Automate app deployment and third-party updates via Auto Apps, VPP, and custom packages. Maintain a curated Self-Service catalog, conduct app inventory audits to remove unapproved software, and enforce macOS, Windows OS, and iOS updates with strict deadlines.
- Security & Compliance: Enforce FileVault encryption, escrow recovery keys, and manage Gatekeeper, XProtect, firewalls, and password policies. Align endpoint controls with CIS benchmarks and supply audit evidence for SOC 2 and ISO 27001 compliance.
- Identity & Trust Integration: Integrate Kandji with Okta for user synchronization, SSO, Kandji Passport, and Okta Device Trust / Device Assurance to ensure only compliant devices access corporate applications.
- Automation & Scripting: Write and maintain Bash, Zsh, and Python scripts for remediations and audits. Leverage the Kandji API and tools like Okta Workflows, Jira, and Slack to automate tickets, alerts, and offboarding workflows.
- Inventory & Hygiene: Maintain a 100% complete and accurate device inventory in Snipe-IT (tracking owners, serials, warranties, and status) while cleaning up stale, duplicate, or unassigned devices.
- Operations & Leadership: Serve as the senior escalation point for complex endpoint issues. Author SOPs, runbooks, and helpdesk guides while training tier-1/2 IT support on platform procedures.
###Your background and skills will include:
- 7+ years of experience managing Apple device fleets primarily using Kandji or Jamf.
- Kandji Certified Administrator or Jamf Certified (300) Certified
- Deep technical experience with macOS and Windows OS configuration profiles, system extensions, Chrome Profile Management, and FileVault.
- Strong scripting skills in Bash/Zsh for device configuration and automated remediation.
- Proven track record packaging, testing, and deploying custom macOS applications.
- Active industry certification: Kandji Certified Administrator OR JAMF Certified Administrator.
- Direct experience integrating Okta with MDM solutions, including Okta Device Trust and Kandji Passport.
- Hands-on expertise utilizing the Kandji API, Kandji MCP, and automation tools (e.g., Okta Workflows). - Thorough understanding of endpoint security fundamentals, baseline controls, and compliance standards.
###These are big plus:
- Experience scripting and automating tasks in Python.
- Prior experience managing Windows endpoints in mixed OS enterprise environments.
- Working knowledge of SOC 2 or ISO 27001 regulatory audit environments.
- Familiarity with building AI agents or advanced workflow scripts to automate IT operational tasks.
- Experience managing Kandji EDR, threat detection, and vulnerability management tools.