About the role

Every Chimer’s laptop is a door into our systems, and you’d own the platform that decides whether that door opens. We’re looking for a Senior Systems Engineer to take the reins on our macOS fleet — Jamf Pro, AutoPkg, zero-touch provisioning — and to sit shoulder-to-shoulder with Security on device trust, so posture checks happen before anyone touches corporate data. We’ve built our access platform entirely in the cloud (Jamf, AutoPkg, Okta, osQuery, CrowdStrike), and there’s a lot still to define: you’ll often be the one framing the problem and getting people aligned on a direction, not waiting for a spec. You’ll report to our IT Engineering Manager and join an after-hours/on-call rotation for critical endpoint issues — we’ll walk you through exactly what that looks like during the interview process.

The base salary offered for this role and level of experience will begin at $152,000 and up to $210,000. Full-time employees are also eligible for a bonus, competitive equity package, and benefits. The actual base salary offered may be higher, depending on your location, skills, qualifications, and experience

In this role, you can expect to

Own our Jamf Pro environment end to end — configuration profiles, smart groups, policies, MDM commands, and the change standards that keep it all sane — and set the technical direction for where it goes next.
Run the AutoPkg pipeline that gets software onto the fleet: recipes, overrides, trust verification, automated import into Jamf, plus packaging, patching, and disk encryption globally.
Make day one work for new Chimers through zero-touch provisioning and enrollment (ADE, Setup Assistant, bootstrap workflows) that just happens without anyone filing a ticket.
Leverage AI and automation tools to accelerate script development, troubleshoot complex endpoint issues, and scale operational workflows.
Write the scripts and integrations (Python, Swift, Bash, Go, plus vendor APIs) that delete manual IT work — and build them so other engineers can adopt them instead of rebuilding them.
Partner with Security to push our Zero Trust model forward, wiring device posture into Okta so device health is a real factor in authentication and app access.
Bring our compliance story to life — CIS-style benchmarks applied with a documented, risk-based rationale, plus the metrics and reporting that show the real inventory, health, and compliance state of every device.
Lead work that crosses IT Support, Security, and People, act as Tier 3 for the gnarliest endpoint problems, and mentor the engineers and technicians around you through documentation, guidance, and example.

To thrive in this role, you have

8+ years managing macOS at scale with an enterprise MDM (Jamf Pro, Kandji, Mosyle) and/or open-source tooling (Munki, Puppet, Chef).
Real production experience with AutoPkg — building and operating recipes, overrides, trust controls, and automated promotion into an MDM.
Familiarity with AI-assisted development and prompt engineering to drive efficiency in automation, documentation, and troubleshooting.
Deep knowledge of Apple’s MDM protocol and Configuration Profile specs, including where Declarative Device Management is taking things.
Command of macOS internals: installers and packages, LaunchDaemons and LaunchAgents, the preferences subsystem, system extensions, built-in security tooling (Endpoint Security Framework, SIP, XProtect, Gatekeeper, openBSM), and unified logs.
Fluency in at least one scripting or general-purpose language (Python, Swift, Bash, Go) for automation and API work, and a solid grasp of Zero Trust / BeyondCorp and how endpoint posture feeds access decisions.
A track record of decisions that span multiple systems, where you have to weigh scalability, compliance, cost, and what someone will have to maintain three years from now.
Comfort in ambiguity and the communication skills to match — you can define a problem, bring stakeholders along, and write the kind of documentation that scales understanding across a distributed team. Bonus points if you bring Jamf Certified Admin (300/400), Terraform or other IaC for SaaS and MDM config, osQuery/CrowdStrike experience, Okta device trust integrations, or Windows endpoint management (Intune, PowerShell, MSI packaging) — Windows is a smaller slice of our fleet.