Senior Endpoint Engineer - macOS & Zero Trust

Thinking Machines Lab; New York, San Francisco (NY, CA); On-site; USD 190,000 - 300,000; Full time

Benefits offered by this job

Health, dental & vision insurance

Unlimited PTO

Paid parental leave

Relocation assistance

Job summary

Thinking Machines Lab is seeking a seasoned IT/endpoint engineer to own macOS fleet management, patching, and security posture. You will lead the migration to Fleet, maintain a secure, scalable MDM platform, and collaborate with Security, Identity, and Infrastructure to deliver a robust employee computing experience.

Located in New York or San Francisco, the role requires strong scripting, IaC, and cross-team communication, with a focus on Zero Trust and automated provisioning.

Qualifications

• 8+ years of experience building and operating secure IT or endpoint systems in complex environments.
• Experience managing a large fleet of macOS devices through a modern MDM platform.
• Experience managing endpoint configuration through scripted deployments, Git-based workflows, or a full GitOps model.
• Deep knowledge of macOS internals, enterprise deployment, security controls, and troubleshooting.
• Experience designing and operating zero-touch Mac provisioning, patching, and software-distribution workflows.
• Experience using device health and security signals to evaluate endpoint compliance.
• Experience successfully delivering complex technical projects from conception through production.
• Strong ability to solve ambiguous problems involving multiple teams and stakeholders.
• Ability to communicate technical concepts clearly to technical and nontechnical audiences.
• A product-engineering mindset toward IT systems, including testing, observability, reliability, and controlled change management.
• A consistent practice of creating clear technical documentation, architecture diagrams, runbooks, and operational procedures.
• Ability to work from either our New York or San Francisco office.

Responsibilities

• Endpoint Configuration as Code: Author, review, test, and deploy macOS configuration profiles, security policies, queries, and remediation scripts.
• MDM Platform Engineering: Operate our MDM platform as a production service, including configuration as code, observability, upgrades, reliability, incident response, and integrations with other IT and Security systems.
• MDM Migration: Lead evaluation, design, testing, and execution of the migration from Iru to Fleet with minimal disruption.
• Santa and Rudolph: Own architecture and operation of Santa and Rudolph synchronization service; manage binary-authorization policies, telemetry, and incident response.
• Zero Trust and Device Trust: Partner with Security to make device trust a core component of Zero Trust; integrate endpoint signals into decisions.
• Continuous Posture Evaluation: Build systems to evaluate device health, patch status, disk encryption, and compliance.
• Patch Management: Build automated macOS patching workflows for rapid enforcement and good user experience.
• Zero-Touch Provisioning: Design and improve ADE workflows that turn a new Mac into a secure configured machine.
• Software Distribution: Own packaging, deployment, updating, and removal across the Mac fleet.
• Fleet Telemetry and Compliance: Query live device state at scale and turn telemetry into policies, dashboards, and alerts.
• Automation: Build tools and AI-assisted workflows to reduce repetitive work and improve reliability.
• Endpoint Security: Partner on macOS hardening, vulnerability management, and device-based access policies.
• Advanced Troubleshooting: Serve as escalation point for complex macOS issues.
• Technical Leadership: Help define the endpoint roadmap and lead architecture decisions.

Skills

Python and shell scripting

macOS internals

GitOps workflows

Infrastructure as Code

Zero Trust concepts

Cross-team problem solving

Technical documentation

Tools

Fleet MDM

Iru (Kandji)

Job description

Thinking Machines Lab is seeking a seasoned IT/endpoint engineer to own macOS fleet management, patching, and security posture. You will lead the migration to Fleet, maintain a secure, scalable MDM platform, and collaborate with Security, Identity, and Infrastructure to deliver a robust employee computing experience.

Located in New York or San Francisco, the role requires strong scripting, IaC, and cross-team communication, with a focus on Zero Trust and automated provisioning.