IT Client Engineer

Linuxcareers; San Jose, Northern (CA, KY); Hybrid; USD 150,000 - 210,000; Full time

Job summary

Figure, an AI Robotics company, seeks a Client Engineer to own endpoint fleet security and management across campuses, factories, and partners. You will implement zero-touch enrollment for macOS/Windows/Ubuntu, translate CIS benchmarks into enforceable policies, and maintain a reproducible fleet with FleetDM and strong RBAC.

Responsibilities include SSO integration with Okta, scripting automation in Python/Bash/PowerShell, and deploying CrowdStrike Falcon with documented playbooks for the IT

Qualifications

• Hands-on production experience managing macOS, Windows, and Ubuntu LTS endpoint fleets.
• Practical experience with zero-touch enrollment and modern endpoint tooling: FleetDM or osquery-based management, Apple Business Manager, and Windows Autopilot or Microsoft Intune.
• Strong scripting skills in Python, Bash, and/or PowerShell with a track record of replacing manual processes with code.
• Working knowledge of authentication fundamentals: SAML, OIDC, SCIM and their tradeoffs; experience administering identity and SaaS platforms at scale (Okta, Google Workspace, Slack, Jira).
• Experience translating security benchmarks (CIS or similar) into enforced, validated configuration policy.
• Sound judgment on security and risk tradeoffs and the ability to explain technical controls to non-technical stakeholders; detail-oriented and process-driven approach to documentation.

Responsibilities

• Own zero-touch enrollment end-to-end across macOS, Windows, and Ubuntu LTS using Apple Business Manager, Windows Autopilot, and PXE provisioning.
• Translate CIS Benchmarks into deterministic configuration profiles with osquery validations across all platforms.
• Operate FleetDM as the cross-platform management agent and maintain standard, reproducible workstation builds with measured patch compliance.
• Design and deploy hardened device configurations for factories and low-connectivity sites, including encryption, conditional access, and remote wipe capabilities.
• Own SSO integration into Okta (SAML and OIDC) and design application authentication and RBAC; automate identity lifecycle provisioning, entitlement, and deprovisioning.
• Build tooling in Python, Bash, or PowerShell to eliminate manual work across onboarding, offboarding, provisioning, and auditing; run license and access audits to recover costs.
• Deploy and maintain CrowdStrike Falcon across the fleet in partnership with Security, and document standards, runbooks, and automation for the broader IT team.

Skills

macOS management

Windows management

Ubuntu LTS

zero-touch enrollment

FleetDM/osquery

SSO authentication

RBAC

Python

Bash

PowerShell

encryption

remote wipe

Tools

Apple Business Manager

Windows Autopilot

PXE provisioning

Okta

Google Workspace

Slack

Jira

Job description

Figure is an AI Robotics company developing a general-purpose humanoid robot for commercial and home use. This Client Engineer role owns Figure's endpoint fleet security and management across all operating sites—corporate campuses, factories, contract manufacturing partners, and field sites. The role combines endpoint engineering, identity and SSO management, and SaaS operations automation to protect the company's core robotic IP through technical controls on devices.

What You'll Do

• Own zero-touch enrollment end-to-end across macOS, Windows, and Ubuntu LTS using Apple Business Manager, Windows Autopilot, and PXE provisioning
• Translate CIS Benchmarks into deterministic configuration profiles with osquery validations across all platforms
• Operate FleetDM as the cross-platform management agent and maintain standard, reproducible workstation builds with measured patch compliance
• Design and deploy hardened device configurations for factories and low-connectivity sites, including encryption, conditional access, and remote wipe capabilities
• Own SSO integration into Okta (SAML and OIDC) and design application authentication and RBAC; automate identity lifecycle provisioning, entitlement, and deprovisioning
• Build tooling in Python, Bash, or PowerShell to eliminate manual work across onboarding, offboarding, provisioning, and auditing; run license and access audits to recover costs
• Deploy and maintain CrowdStrike Falcon across the fleet in partnership with Security, and document standards, runbooks, and automation for the broader IT team

What You Need

• Hands-on production experience managing macOS, Windows, and Ubuntu LTS endpoint fleets
• Practical experience with zero-touch enrollment and modern endpoint tooling: FleetDM or osquery-based management, Apple Business Manager, and Windows Autopilot or Microsoft Intune
• Strong scripting skills in Python, Bash, and/or PowerShell with a track record of replacing manual processes with code
• Working knowledge of authentication fundamentals: SAML, OIDC, SCIM and their tradeoffs; experience administering identity and SaaS platforms at scale (Okta, Google Workspace, Slack, Jira)
• Experience translating security benchmarks (CIS or similar) into enforced, validated configuration policy
• Sound judgment on security and risk tradeoffs and the ability to explain technical controls to non-technical stakeholders; detail-oriented and process-driven approach to documentation

Nice to Have

• Experience supporting devices or users at manufacturing sites, contract manufacturers, or other high-IP-risk environments
• Familiarity with export control, data residency, or IP protection frameworks in hardware and software R&D
• Experience deploying or operating EDR agents at fleet scale such as CrowdStrike Falcon
• Experience building integrations against SaaS APIs and identity providers; supporting engineering workloads on Linux including workstation and build-host management; standing up IT capability at new sites or supporting international growth