IT Systems Engineer

Ibotta, Inc.; Denver, Northern (CO, KY); Hybrid; USD 100,000 - 110,000; Full time

Benefits offered by this job

Benefits package

Employee Stock Purchase Program

401k match

Denver office perks

Job summary

Ibotta, located in Denver, CO, seeks an IT Systems Engineer focused on endpoint and device management. You will own day-to-day build, automation, and security posture for Mac and Windows fleets via Jamf Pro and Microsoft Intune, provisioning, patching, compliance, and identity-integrated device access.

This hybrid role requires 3 in-office days (Tue–Thu) and candidates must reside in the United States. Relocation bonus offered if you are not based in Denver.

Qualifications

• 4+ years in endpoint engineering, systems administration, or IT operations.
• Bachelor's degree in CS/IT/IS preferred; equivalent experience accepted.
• Hands-on with Jamf Pro and Microsoft Intune on macOS and Windows.
• Scripting proficiency in at least one language; others welcome.
• Knowledge of IdP, device compliance, and conditional access.
• Experience with patch management across a distributed fleet.
• Experience provisioning devices at scale (zero-touch, Autopilot, ABM/DEP).
• Kanban/Agile; ticket-driven work with documentation.
• Strong written and verbal communication.
• Ability to meet deadlines and adapt to priorities.

Responsibilities

• Administer Jamf Pro and Microsoft Intune enrollment and config profiles.
• Implement zero-touch provisioning and authentication workflows.
• Maintain security baselines and CIS/SCUBA compliance.
• Drive Windows patch automation to parity with macOS.
• Develop scripts for patch deployment, packaging, and lifecycle automation.
• Maintain infrastructure/automation code in Git with PR reviews.
• Package, deploy, and version third-party apps across fleet.
• Own fleet lifecycle: provisioning, refreshes, recovery, offboarding.
• Serve as Tier 3 for endpoint incidents; perform root-cause analysis.
• Create knowledge base, runbooks, and training for desktop support.

Skills

Jamf Pro

Microsoft Intune

PowerShell

Bash

Python

Swift

Zero-touch provisioning

Automation

Git

Jira

Education

Bachelor's degree or equivalent

Tools

Apple Business Manager

Platform SSO

Windows Autopilot

Okta

Entra ID

Job description

Ibotta is seeking an IT Systems Engineer focused on endpoint and device management to join our IT team and contribute to our mission to Make Every Purchase Rewarding. Reporting to the Engineering Manager, IT, this engineer owns the day-to-day build, automation, and security posture of our Mac and Windows fleet across Jamf Pro and Microsoft Intune. You will implement and operate the platforms that every Ibotta employee touches daily — provisioning, patching, compliance, and identity-integrated device access — and you will partner across IT, Security, and the business to move manual work into automated workflows.

This position is located in Denver, Colorado as a hybrid position requiring 3 days in office (Tuesday, Wednesday, and Thursday). Candidates must live in the United States.

Not based in Denver? We will offer a relocation bonus to help make your move to the Mile High City a smooth one.

What you will be doing

• Administer Jamf Pro (macOS/iOS) and Microsoft Intune (Windows) enrollment, configuration profiles, compliance policies, and OS update cycles

• Implement zero-touch provisioning across both platforms (Apple Business Manager, Platform SSO, Windows Autopilot) and support authentication workflows with Security/Identity (Managed Apple IDs, Okta Verify, Windows Hello, hardware MFA keys)

• Build and maintain security baselines/hardening configs; remediate findings against internal and CIS/SCUBA benchmarks

• Drive the Windows endpoint patch automation program to parity with the existing macOS patch pipeline

• Develop and maintain scripts (Bash, Python, Swift, PowerShell) for patch deployment, packaging, self-remediation, extension attributes, and lifecycle automation; convert manual tasks into documented, version-controlled workflows

• Maintain infrastructure/automation code in Git with branching standards, PRs, and peer review as the default path to production

• Package, deploy, and version third-party applications across the fleet

• Own full fleet lifecycle operations, enrollment, provisioning, refreshes, recovery, and secure offboarding, aligned with Jira Assets and asset management frameworks

• Serve as Tier 3 escalation for endpoint incidents, performing root-cause analysis and converting findings into permanent fixes; manage endpoint-adjacent services (PaperCut print/badging, device access control); work Jira Service Management tickets with SLA/documentation discipline

• Create knowledge base articles, runbooks, and training for Desktop Support/System Administration to enable delegated MDM tasks at the right tier

• Support continuous security monitoring and audit evidence collection; identify gaps and propose efficiency improvements

• Embrace and uphold Ibotta's Core Values: Integrity, Boldness, Ownership, Teamwork, Transparency & A good idea can come from anywhere

What we are looking for

• 4+ years in endpoint engineering, systems administration, or IT operations in a mixed Mac and Windows environment

• Bachelor's degree in Computer Science,Information Technology or Information Systems preferred; equivalent experience accepted

• Hands-on production experience with both Jamf Pro and Microsoft Intune. Depth in one platform with demonstrated working competence in the other is acceptable

• Proficiency in at least one scripting language for device automation (PowerShell, Bash, Python, or Swift), and willingness to work in the others

• Working knowledge of an enterprise IdP (Okta preferred; Entra ID acceptable) and how identity, conditional access, and device compliance interact

• Experience with patch management and OS update strategy across a distributed fleet

• Experience supporting device provisioning at scale (zero-touch, Autopilot, ABM/DEP)

• Kanban/Agile working style; comfort operating in a ticket-driven queue with documentation expectations

• Great communication skills, both written and verbal

• Ability to meet deadlines and adjust to changing priorities

• Ability to devise non-traditional solutions to meet business needs

About Ibotta ("I bought a...")

Ibotta (NYSE: IBTA) is a leading performance marketing platform allowing brands to deliver digital promotions to over 200 million consumers through a network of publishers called the Ibotta Performance Network (IPN). The IPN allows marketers to influence what people buy, and where and how often they shop – all while paying only when their campaigns directly result in a sale. American shoppers have earned over $1.8 billion through the IPN since 2012. The largest tech IPO in history to come out of Colorado, Ibotta is headquartered in Denver, and is continually listed as a top place to work by The Denver Post and Inc. Magazine.

To learn more about what our Tech teams are doing day to day, visit Building Ibotta on Medium.com

Additional Details:

• This position is located in Denver, CO and includes competitive pay, flexible time off, benefits package (including medical, dental, vision), Employee Stock Purchase Program, and 401k match. Denver office perks include paid parking, snacks, and occasional meals.

• Base compensation range: $100,000 - $110,000. Equity is included in overall compensation package. This compensation range is specific to the United States labor market and may be adjusted based on actual experience.

• Ibotta is an Equal Opportunity Employer. Ibotta’s employment decisions are made without regard of race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, sexual orientation, or any other legally protected status.

• Applicants must be currently authorized to work in the United States on a full-time basis.

• Applicants are accepted until the position is filled.

• For the security of our employees and the business, all employees are responsible for the secure handling of data in accordance with our security policies, identifying and reporting phishing attempts, as well as reporting security incidents to the proper channels.

Recruiting Agency Notice

Ibotta does not accept agency resumes and is not responsible for any fees related to unsolicited resumes. Please do not forward resumes to any Ibotta employees.