Senior Endpoint Engineer

Apex Fintech Solutions • Austin, TX

11d • Hybrid

About The Position

Apex Fintech Solutions is hiring a Senior Endpoint Engineer to own and evolve the enrollment, configuration, security, patching, and retirement of Windows and Mac devices. The engineer will serve as the technical lead for Microsoft Intune on Windows; Jamf Pro or Kandji and Apple Business Manager on macOS; and Entra ID Conditional Access or Okta device-trust controls.

The role treats device management as software engineering: policies, profiles, and scripts are maintained as code, reviewed in Git, deployed in stages, and designed to be reversible. The engineer will integrate mobile device management, identity, and cloud systems while replacing manual work with automation. Responsibilities also include endpoint security, app packaging and deployment, incident escalation, technical standards, architecture documentation, mentoring, and evaluating tools and AI-enabled improvements.

Requirements

• Bachelor's degree in computer science or a related technical discipline, or equivalent work experience.
• At least 6 years of endpoint or systems engineering experience, including hands-on administration of Microsoft Intune and an Apple MDM such as Jamf Pro or Kandji.
• Deep Intune expertise, including compliance, configuration profiles, Autopilot, app protection, Scope Tags, and custom RBAC roles.
• Strong Jamf Pro or Kandji experience, including policies or Blueprints, configuration profiles, and zero-touch enrollment.
• Apple Business Manager experience with automated enrollment, VPP, and MDM server integration.
• Demonstrated policy-as-code and GitOps experience, including infrastructure as code and CI pipelines with code review.
• Strong automation skills with PowerShell, Python, and Microsoft Graph API.
• Strong Azure experience, including automation and integrations using services such as Azure Automation, Logic Apps, and Azure Functions.
• Entra ID administration experience, including dynamic groups, app registrations, hybrid identity, and production Conditional Access design.
• Vulnerability management, patching, and application-packaging experience, including relevant tools or approaches such as Defender Vulnerability Management, Rapid7, Qualys, Patch My PC, Winget, PSADT, IntuneWin, or PKG.
• Solid grounding in Windows and macOS architecture, Kerberos, SAML, OAuth/OIDC, and certificate-based authentication such as SCEP/PKCS.
• Strong documentation and communication skills, including the ability to explain tradeoffs to technical and non-technical audiences.

Nice To Haves

• Okta experience.
• AWS experience, including automation and integrations using services such as Lambda, Step Functions, and EventBridge.
• Experience using AI in production to solve operational problems.
• Experience applying CIS Benchmarks and NIST frameworks, such as 800-53 or CSF, to endpoint compliance baselines.
• Microsoft certifications such as MD-102, SC-300, AZ-104, or AZ-500; Apple certifications; or AWS or Azure cloud certifications.
• ServiceNow or similar ITSM experience.

Responsibilities

• Own Microsoft Intune endpoint management, including compliance, configuration profiles, Autopilot, app deployment, Scope Tags, and RBAC.
• Manage the Apple device lifecycle through Jamf Pro or Kandji and Apple Business Manager, including zero-touch enrollment and app deployment.
• Design and enforce Entra ID Conditional Access and Okta device-trust policies in partnership with security and identity teams.
• Implement macOS and Windows MDM policy as code using a GitOps model, including CI/CD, peer review, staged rollouts, and rollback.
• Own managed-browser and browser-extension policy and maintain an auditable control plane.
• Build integrations and automation across endpoint, identity, and cloud platforms using PowerShell, Python, Microsoft Graph, and Azure or AWS services.
• Automate patching and third-party application updates to reduce exposure windows while minimizing employee disruption.
• Build dashboards, drift alerts, and AI-assisted automation using fleet telemetry to reduce operational toil.
• Package and deploy applications, including Win32, MSI, PKG, and DMG packages, with detection, dependency, and rollback planning.
• Partner with Information Security to remediate vulnerabilities and harden endpoints against CIS Benchmarks, mapped to NIST controls.
• Serve as the escalation point for complex endpoint incidents, leading root-cause analysis and durable fixes.
• Set technical standards, document architecture decisions, and mentor engineers.
• Evaluate new tools and apply AI to operational problems to improve security, reliability, and user experience.

Benefits

• Healthcare benefits, including medical, dental, vision, and EAP.
• Competitive PTO.
• 401(k) match.
• Parental leave.
• HSA contribution match.
• Paid Calm app subscription.
• External learning benefits.
• Tuition reimbursement.
• Hybrid work schedule with flexibility to work from home and from a primary office.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior