Endpoint Engineer

Apex Fintech Solutions LLC; Austin (TX); Hybrid; USD 90,000 - 130,000; Full time

Benefits offered by this job

Healthcare benefits

401k match

Parental leave

Hybrid work schedule

Tuition reimbursement

Calm app subscription

Job summary

Apex Fintech Solutions LLC is seeking an Endpoint Engineer to own device enrollment, configuration, security, patching, and retirement. You will manage Intune for Windows and Kandji for Macs, tying device trust to access with Entra ID Conditional Access. Jamf Pro experience is a plus.

You will migrate policies to cloud-native MDM, automate deployments, and maintain RBAC across platforms. A collaborative security-focused team environment is expected, with a hybrid work setup.

Qualifications

• 2+ years in systems/endpoint engineering with hands-on MDM administration (Intune, Kandji or Jamf Pro).
• Experience with modern MDM and cloud-native configuration.
• Strong scripting ability in PowerShell and Python.

Responsibilities

• Own end-to-end Intune administration: compliance policies, config profiles, app deployment, Autopilot/WEnrollment, RBAC design.
• Manage Kandji or Jamf Pro for Apple devices and ABM integration.
• Design and enforce Entra ID Conditional Access policies with security/identity teams.
• Migrate legacy GPOs to cloud-native MDM configurations and document gaps.
• Build RBAC models across Intune, Entra ID, Kandji/Jamf Pro.
• Develop automation/scripts for endpoint and identity workflows (PowerShell, Python, Graph API).
• Support BYOD MDM for Windows/Mac/Linux/Android devices.

Skills

Intune administration

Kandji/Jamf Pro

ABM/Apple Business Manager

GPO to cloud migration

Entra ID/Azure AD

Conditional Access

Scripting (PowerShell/Python)

Windows/macOS proficiency

RBAC modeling

Documentation

Linux/macOS admin

Tools

Microsoft Intune

Jamf Pro

Kandji

Apple Business Manager

Azure AD/Entra ID

PowerShell

Python

Microsoft Graph API

Job description

Who We Are

Apex Fintech Solutions (Apex) powers innovation and the future of digital wealth management by building tech-forward solutions that help simplify, automate, and facilitate access to financial markets for all. Our robust suite of fintech software enables us to support clients such as Stash, Betterment, SoFi, Webull, and eToro, amongst many others; collectively, Apex powers access to the stock market for over 22+ million end customers.

Who We Are

Apex Fintech Solutions (Apex) powers innovation and the future of digital wealth management by building tech-forward solutions that help simplify, automate, and facilitate access to financial markets for all. Our robust suite of fintech software enables us to support clients such as Stash, Betterment, SoFi, Webull, and eToro, amongst many others; collectively, Apex powers access to the stock market for over 22+ million end customers.

At Apex, we are changing how the securities industry operates by reinventing the status quo, which was manual, slow, and accessible only by the ultra-wealthy. We're digitizing and democratizing systems so that everyone has an opportunity to invest.

When you're at Apex, you drive this change. You're part of a global team with a clear vision: to be the trusted technology that powers the digital economy. Our offices in Austin, Dallas, Chicago, New York, Portland, Belfast, and Manila are home to over 1,000 employees.

Together, we’re shaping the future of financial innovation. Embrace change. Solve big. Win together. And be G.R.E.A.T. — grit, results, empathy, accountability, and teamwork — with Apex.

We’re Proud To Be Recognized For The Innovative Work We Do, The Purpose-driven Nature Of Our Work, And The Collaborative Culture We’ve Created. Here Are Just a Few Of The Many Awards We’ve Recently Received
Best Places to Work
2026, 2025, 2024, 2023 - Presented by BuiltIn
WealthTech of the Year
2025 - Presented by US FinTech Awards
The World’s Top 250 Fintech Companies
2024 - Presented by CNBC

About This Role

About the Role

We’re hiring an Endpoint Engineer to own how our devices are enrolled, configured, secured, patched, and retired. You’ll run Microsoft Intune for Windows, Kandji with Apple Business Manager for Macs, and Entra ID Conditional Access to tie device trust to access. Jamf Pro experience transfers well.

Much of the work is hands‑on Intune delivery: migrating legacy Group Policy to cloud-native configuration, packaging and deploying apps (Win32, MSI, PKG), keeping third‑party apps current, and remediating vulnerabilities across the fleet.

Everything you ship is automated, version-controlled, and reproducible, using PowerShell, Python, Microsoft Graph, and Git‑based pipelines.

You’ll work closely with our security and identity teams to define how corporate and BYOD devices prove compliance and earn access to company resources.

What You’ll Do

• Own end-to-end Intune administration: compliance policies, configuration profiles, app deployment, Autopilot/Windows enrollment, Scope Tags, and RBAC design across business units.
• Manage Apple device lifecycle via Kandji + Apple Business Manager (ABM): DEP enrollment, supervised device policies, app deployment, and zero-touch provisioning.
• Design and enforce Conditional Access policies in Entra ID (device compliance, location, risk-based sign-in, session controls) in coordination with security/identity teams.
• Work with Endpoint engineering team on migration of legacy Group Policy Objects (GPOs) to Intune/Entra-based configuration and compliance policies, including translating GPO logic 1:1 where needed and documenting gaps.
• Build and maintain RBAC models across Intune, Entra ID, and Kandji.
• Develop automation/scripting for endpoint and identity workflows (PowerShell, Python, Microsoft Graph API).
• Implement and maintain MDM solutions for BYOD devices for Windows/Mac/Linux/Android devices.

Required Skills & Experience

• 2+ years in systems/endpoint engineering, including hands‑on administration of modern MDM (Intune, plus Kandji or Jamf Pro).
• Deep, hands‑on Microsoft Intune expertise: compliance policies, configuration profiles, app protection/app config policies, Autopilot, Scope Tags, RBAC (built‑in and custom roles).
• Kandji or Jamf Pro administration (Blueprints/policies, Library Items/config profiles, Liftoff or equivalent zero‑touch enrollment).
• Apple Business Manager (ABM): DEP, VPP, device assignment, MDM server integration.
• Hands‑on Group Policy (GPO) experience and proven experience migrating GPO logic to cloud‑native MDM/compliance policy equivalents.
• Entra ID (Azure AD) administration: users/groups, dynamic groups, app registrations, enterprise apps, hybrid identity.
• Conditional Access policy design and troubleshooting (sign‑in logs, what‑if tool, break-glass account practices).
• Scripting proficiency: PowerShell, Python, Shell, Microsoft Graph API.
• Solid understanding of Windows and macOS device architecture, authentication protocols (Kerberos, SAML, OAuth/OIDC), and certificate‑based auth (SCEP/PKCS).
• Strong documentation habits and ability to communicate technical tradeoffs to both engineering and non‑technical stakeholders.
• Linux and macOS administration— command‑line fluency, shell scripting, and system‑level troubleshooting beyond GUI‑based management.

Nice to Have

• Microsoft certifications (MS‑102 Endpoint Administrator, SC‑300 Identity and Access Administrator, AZ‑500).
• Apple certifications (Apple Certified Support Professional / Apple Deployment and Management).
• Experience with Okta or other third‑party IdPs alongside Entra ID.
• Experience with security frameworks/benchmarks (CIS, NIST) as applied to endpoint compliance baselines.
• ServiceNow or similar ITSM tooling for change management and automation triggers

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties, and responsibilities required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.

Our Rewards

We offer a robust package of employee perks and benefits, including healthcare benefits (medical, dental and vision, EAP), competitive PTO, 401k match, parental leave, and HSA contribution match. We also provide our employees with a paid subscription to the Calm app and offer generous external learning and tuition reimbursement benefits. At AFS, we offer a hybrid work schedule for most roles that allows employees to have the flexibility of working from home and one of our primary offices.

EEO Statement

Apex Fintech Solutions is an equal opportunity employer that does not discriminate on the basis of race, color, religion, sex (including pregnancy, sexual orientation, and gender identity), national origin, age, disability, veteran status, marital status, or any other protected characteristic. Our hiring practices ensure that all qualified applicants receive fair consideration without regard to these characteristics.

Disability Statement

Apex Fintech Solutions is committed to creating an inclusive and accessible workplace for all candidates, including those with disabilities. We are dedicated to ensuring equal employment opportunities and providing reasonable accommodations to qualified individuals with disabilities. If you require reasonable accommodations to participate in the application or interview process, please submit your request via the Candidate Accommodation Requests Form. We will work with you to provide the necessary accommodations to ensure your full participation in our hiring process.