Systems Engineer - W2 Role

Scale and support the existing fleet (500+ Macs, plus iOS and Android devices). Own administration of Gravie’s Jamf Cloud instance: MDM, declarative device management (DDM), VPP, smart groups, policies, scripts, packaging, and automated device enrollment. Support rollout of Apple Platform SSO. Use Okta Device Trust to control access to internal systems from managed and BYOD devices. Administer and automate Google endpoint management for BYOD Android devices and company-owned Chromebooks. Refine existing patch management workflows for macOS, iOS, and Android, using staged deployment rings, compliance targets, and reporting. Work with Security to monitor software installed on employee devices and automate blocking and removal of unnecessary or unapproved applications. Deploy and maintain required security agents, certificates, and network profiles across managed endpoints. Audit device health and inventory, and manage software and device licensing. Implement and document endpoint controls required for SOC 2 compliance and support audit evidence collection. Build Windows endpoint management for Amazon WorkSpaces virtual desktops from the ground up: evaluate and implement tooling, build and maintain images, and establish patching, configuration, and compliance baselines. Troubleshoot MDM enrollment, policy, and app deployment issues, and act as escalation point for end-user support. Create and maintain internal runbooks and end-user documentation.

We’re looking for an experienced Systems Engineer to own management of our physical and virtual endpoint fleet: Macs, Chromebooks, iOS/Android devices, and Amazon WorkSpaces virtual desktops. You’ll improve and automate how we deploy, secure, and patch devices, tie device posture into access decisions, and support SOC 2 compliance. The ideal candidate has a passion for automation and for creating outstanding user experiences. Hybrid in Minneapolis preferred; remote candidates considered., 3+ years of hands-on MDM experience across macOS and iOS, plus Android. Experience with endpoint security best practices (hardening, encryption, least privilege). Experience with declarative device management for macOS and iOS. Working knowledge of Jamf Pro/Cloud administration and Apple Business Manager. Familiarity with Google Workspace and Google endpoint management administration. Solid Git and scripting skills (bash/zsh/Python). Experience working with APIs for system interoperability. Ability to work independently and prioritize across competing operational and project work.

Nice to have Familiarity with HIPAA, SOC 2, or similar compliance frameworks. Okta Identity Engine and Okta Workflows experience. Experience with ZTNA and DLP solutions such as Netskope. Windows endpoint management (Intune or similar) and image management in VDI environments, such as Amazon WorkSpaces. Experience with ITSM tooling (Freshservice or similar) and automation of onboarding/offboarding workflows. Experience with the AWS Console.