Endpoint & Identity Engineer for AI Robotics

Figure-; San Jose (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Figure, a San Jose based AI robotics company, seeks a Client Engineer to own the endpoint fleet across campus, factories, and field sites. You’ll lead zero-touch enrollment, enforce CIS-aligned configurations, and operate FleetDM across macOS, Windows, and Ubuntu, while partnering with Security to protect IP and data.

The role emphasizes coding over manual IT work—building scripts in Python, Bash, or PowerShell to automate onboarding, offboarding, provisioning, and audits.

Qualifications

• Hands-on experience managing macOS, Windows, and Linux (Ubuntu LTS) endpoint fleets in production.
• Experience with zero-touch enrollment and endpoint tooling: FleetDM or comparable osquery-based management, Apple Business Manager, Windows Autopilot or Microsoft Intune.
• Experience turning security benchmarks into enforceable, validated configuration policy.
• Strong scripting skills in Python, Bash, and/or PowerShell, with a track record of replacing manual processes with code.
• Working knowledge of authentication fundamentals: SAML, OIDC, SCIM, and the tradeoffs between them.
• Experience administering identity and SaaS platforms at scale: Okta, Google Workspace, Slack, Jira, including SCIM and API-driven provisioning.
• Sound judgment on security and risk tradeoffs, and the ability to explain technical controls to non-technical stakeholders.
• Detail-oriented and process-driven, particularly in documenting standards and policy.
• Great communication, collaboration, and interpersonal skills.

Responsibilities

• Own zero-touch enrollment end to end: Apple Business Manager for macOS, Windows Autopilot for Windows, and PXE provisioning for Ubuntu workstations.
• Translate CIS Benchmarks into deployable configuration profiles across all platforms: deterministically applied settings accompanied with osquery validations to validate posture.
• Operate FleetDM as the cross-platform management agent across macOS, Windows, and Ubuntu LTS.
• Maintain standard, reproducible workstation builds with measured and enforced patch compliance.
• Build hardened device configurations for factories, contract manufacturers, and low-connectivity sites: loaner and clean-device programs, encryption enforcement and escrow, conditional access, and remote wipe and recovery.
• Deploy and maintain CrowdStrike Falcon coverage across the fleet in partnership with Security, closing gaps on unmanaged or drifted devices.
• Translate data handling and IP protection requirements from Security, Legal, and Engineering leadership into enforceable technical controls.

Skills

macOS fleet

Windows fleet

Ubuntu Linux

FleetDM

Okta SSO

SAML/OIDC

PowerShell

Python

Tools

Apple Business Manager

Windows Autopilot

PXE provisioning

CrowdStrike Falcon

Google Workspace

Slack

Jira

Job description

Figure, a San Jose based AI robotics company, seeks a Client Engineer to own the endpoint fleet across campus, factories, and field sites. You’ll lead zero-touch enrollment, enforce CIS-aligned configurations, and operate FleetDM across macOS, Windows, and Ubuntu, while partnering with Security to protect IP and data.

The role emphasizes coding over manual IT work—building scripts in Python, Bash, or PowerShell to automate onboarding, offboarding, provisioning, and audits.