- Location: Remote — Available to work during US Hours (8:00 AM PST to 6:00 PM PST or India Hours (8:00 am IST to 6:00 pm IST)
- Experience Level: Senior / Lead
- Work Type: Full-Time
Company
Our client provides real-time measurement and intelligence for streaming media. The company also manages endpoint security and IT operations across global teams, with an emphasis on audit readiness.
About the Role
Own the Kandji (now Iru) platform end to end as a hands-on Apple and Windows endpoint management engineer. You’ll manage devices day to day and automate how they’re deployed, patched, secured and kept compliant—from zero-touch new-hire setup to policy controls and an accurate, audit-ready inventory. This is a device management engineering role, not a helpdesk or IT support role.
What you’ll do:Device
Device Enrollment and Lifecycle - Own zero-touch deployment through Apple Business Manager (ABM) and Automated Device Enrollment (ADE). - Design and maintain the new-hire setup experience, from opening the box to a fully configured, secure device. - Automate and Manage the full device lifecycle: purchase, enrollment, reassignment, repair, offboarding, laptop operations, secure wipe and retirement.
Blueprints and Configuration - Design and maintain blueprints (device configuration templates) by role, department and device type. - Build and manage configuration profiles, custom profiles and library items. - Standardize settings for Wi-Fi, VPN, certificates, privacy permissions (PPPC/TCC), system extensions and login items. - Review blueprints regularly. Consolidate duplicates and remove unused library items.
App Management - Automate, Deploy and update apps through Auto Apps, the App Store (VPP) and custom app packages. - Maintain a curated Self Service catalog with clear categories. - Keep an app inventory. Find unapproved or vulnerable software and remove it. - Package, script and test custom apps before they go out widely. - Keep third-party apps patched automatically and track exceptions.
Patching and OS Updates - Own macOS, Windows OS and iOS update enforcement, with clear deadlines and user communication. -Test new macOS and iOS releases before they reach the company.
Security and Compliance - Enforce FileVault encryption, escrow recovery keys, and control who can retrieve them. - Manage Gatekeeper, XProtect, the firewall, screen lock and password policies. - Manage local admin rights, including temporary admin access where needed. - Map device controls to CIS benchmarks and compliance templates. - Manage Kandji EDR, threat detections and vulnerability management, and work with Security on fixes. - Provide device evidence for SOC 2, ISO 27001 and internal audits.
Identity Integration - Integrate Kandji with Okta for user sync, automatic device assignment and SSO. - Set up Okta Device Trust and device assurance so only managed, compliant devices can reach company apps. - Set up Kandji Passport (Mac sign-in with Okta) for password sync on Macs. - Keep device-to-user assignments accurate as people join, move teams or leave.
Automation and Scripting - Write and maintain scripts in Bash, Zsh and Python for fixes, audits and device checks. -Use the Kandji API for bulk tasks, reporting and integrations. - Connect Kandji with Jira, Slack and Okta Workflows for alerts, tickets and offboarding steps.
Inventory, Reporting and Hygiene -Keep a complete, accurate device inventory in Snipe IT: owner, location, model, warranty and status. - Find and clean up stale, unassigned, duplicate or offline devices. -Track warranty, AppleCare and refresh cycles, and plan hardware replacements. -Report regularly on compliance, patch status, encryption and security posture.
Operations and Support - Act as the escalation point for enrollment, profile, app and device problems. - Write and maintain runbooks, SOPs and helpdesk guides. - Train the IT helpdesk on Kandji procedures. - Evaluate new Kandji features and Apple platform changes, and plan how to adopt them. - Experience working in a SOC 2 or ISO 27001 environment. -Some Windows device management experience, for mixed-device environments.
Your background and skills will include:
- 7+ years managing Apple devices primarily with Kandji (or Jamf)
- Deep experience with macOS and Windows OS configuration profiles, system extensions, Chrome Profile Management and FileVault.
- Automation / Scripting in Bash/Zsh, with Python as a plus. Experience with the Kandji API ,
- Experience packaging and deploying macOS 3rd party apps.
- Experience with other MDMs (Jamf) can be considered.
- Certifications: Kandji Certified Administrator OR/ JAMF 300 Certified Administrator
- Experience integrating Okta with an MDM, including Device Trust and Kandji Passport.
- Experience working with Inventory Management
These are big plus:
- Experience working with Model Context Protocol and building AI Agents for automating operations.
- Experience working in a SOC 2 or ISO 27001 environment.
- Code42 for backups, Crowdstrike for AV
- Terraform experience
- Familiarity with Google Workspace, Slack, Okta integrations.