Endpoint & Identity Engineer for AI Robotics Fleet

Figure; San Jose (CA); On-site; USD 180,000 - 210,000; Full time

Job summary

Figure is an AI Robotics company building a general-purpose humanoid headquartered in San Jose. We seek a Client Engineer to own the endpoint fleet across our campus, factories, and partner sites, handling provisioning, policy, and security controls for devices both on and off the corporate network.

You will lead client-side infrastructure (macOS, Windows 11 Pro, Ubuntu LTS), own Okta-based SSO, and automate IT work with code.

Qualifications

• Hands-on experience managing macOS, Windows, and Linux endpoint fleets in production.
• Experience with zero-touch enrollment and modern endpoint tooling like FleetDM, Apple Business Manager, Windows Autopilot or Intune.
• Ability to translate CIS benchmarks into enforced, validated configuration policy.
• Strong scripting skills in Python, Bash, and/or PowerShell, replacing manual work with code.
• Experience administering identity and SaaS platforms at scale: Okta, Google Workspace, Slack, Jira (SCIM and API provisioning).
• Good discernment of security and risk tradeoffs; able to explain controls to non-technical stakeholders.
• Detail-oriented, process-driven, and capable of documenting standards and policy.
• Excellent communication, collaboration, and interpersonal skills.

Responsibilities

• Own zero-touch enrollment end to end: Apple Business Manager for macOS, Windows Autopilot for Windows, and PXE provisioning for Ubuntu.
• Translate CIS Benchmarks into deployable configuration profiles with osquery validations.
• Operate FleetDM as the cross-platform management agent for macOS, Windows, and Ubuntu LTS.
• Maintain standard, reproducible workstation builds with patch compliance.
• Build hardened device configurations for factories, contract manufacturers, and low-connectivity sites; enable remote wipe and encryption.
• Deploy and maintain CrowdStrike Falcon coverage across the fleet with Security.
• Translate data handling and IP protection requirements into enforceable technical controls.
• Own SSO integration of applications into Okta (SAML and OIDC); design RBAC for applications.
• Automate identity lifecycle end-to-end: provisioning, entitlement, deprovisioning via Okta Workflows with Google Workspace, Slack, Jira.
• Build tooling in Python, Bash, or PowerShell to eliminate manual work across onboarding/offboarding/provisioning.
• Run license and access audits; surface inactive accounts and drive cost recovery with Procurement.
• Document standards, runbooks, and automation; mentor Operations Specialists.

Skills

macOS

Windows

Linux / Ubuntu

FleetDM

osquery

Apple Business Manager

Windows Autopilot

Intune / MDM

Okta SSO

SAML / OIDC

SCIM provisioning

Python

PowerShell

Bash

RBAC design

Zero-touch enrollment

Tools

FleetDM

osquery

Okta

Google Workspace

Slack

Jira

Microsoft Intune

Job description

Figure is an AI Robotics company building a general-purpose humanoid headquartered in San Jose. We seek a Client Engineer to own the endpoint fleet across our campus, factories, and partner sites, handling provisioning, policy, and security controls for devices both on and off the corporate network.

You will lead client-side infrastructure (macOS, Windows 11 Pro, Ubuntu LTS), own Okta-based SSO, and automate IT work with code.