IT Systems Engineer

Ibotta•Denver, CO

7d•$100,000 - $110,000•Hybrid

About The Position

Ibotta is seeking an IT Systems Engineer focused on endpoint and device management to join our IT team. This engineer will be responsible for the day-to-day build, automation, and security posture of our Mac and Windows fleet across Jamf Pro and Microsoft Intune. The role involves implementing and operating platforms for provisioning, patching, compliance, and identity-integrated device access, and partnering across IT, Security, and the business to automate manual workflows. This is a hybrid position located in Denver, Colorado, requiring 3 days in the office per week. Candidates must live in the United States, and a relocation bonus is offered for those not based in Denver.

Requirements

4+ years in endpoint engineering, systems administration, or IT operations in a mixed Mac and Windows environment
Hands-on production experience with both Jamf Pro and Microsoft Intune. Depth in one platform with demonstrated working competence in the other is acceptable
Proficiency in at least one scripting language for device automation (PowerShell, Bash, Python, or Swift), and willingness to work in the others
Working knowledge of an enterprise IdP (Okta preferred; Entra ID acceptable) and how identity, conditional access, and device compliance interact
Experience with patch management and OS update strategy across a distributed fleet
Experience supporting device provisioning at scale (zero-touch, Autopilot, ABM/DEP)
Kanban/Agile working style; comfort operating in a ticket-driven queue with documentation expectations
Great communication skills, both written and verbal
Ability to meet deadlines and adjust to changing priorities
Ability to devise non-traditional solutions to meet business needs
Applicants must be currently authorized to work in the United States on a full-time basis.

Nice To Haves

Bachelor's degree in Computer Science, Information Technology or Information Systems preferred; equivalent experience accepted

Responsibilities

Administer Jamf Pro (macOS/iOS) and Microsoft Intune (Windows) enrollment, configuration profiles, compliance policies, and OS update cycles
Implement zero-touch provisioning across both platforms (Apple Business Manager, Platform SSO, Windows Autopilot) and support authentication workflows with Security/Identity (Managed Apple IDs, Okta Verify, Windows Hello, hardware MFA keys)
Build and maintain security baselines/hardening configs; remediate findings against internal and CIS/SCUBA benchmarks
Drive the Windows endpoint patch automation program to parity with the existing macOS patch pipeline
Develop and maintain scripts (Bash, Python, Swift, PowerShell) for patch deployment, packaging, self-remediation, extension attributes, and lifecycle automation; convert manual tasks into documented, version-controlled workflows
Maintain infrastructure/automation code in Git with branching standards, PRs, and peer review as the default path to production
Package, deploy, and version third-party applications across the fleet
Own full fleet lifecycle operations, enrollment, provisioning, refreshes, recovery, and secure offboarding, aligned with Jira Assets and asset management frameworks
Serve as Tier 3 escalation for endpoint incidents, performing root-cause analysis and converting findings into permanent fixes; manage endpoint-adjacent services (PaperCut print/badging, device access control); work Jira Service Management tickets with SLA/documentation discipline
Create knowledge base articles, runbooks, and training for Desktop Support/System Administration to enable delegated MDM tasks at the right tier
Support continuous security monitoring and audit evidence collection; identify gaps and propose efficiency improvements
Embrace and uphold Ibotta's Core Values: Integrity, Boldness, Ownership, Teamwork, Transparency & A good idea can come from anywhere