Endpoint Engineer
New York City • FullTime
Posted 1mo ago
About the job
Legora is seeking an Endpoint Engineer to join their IT and AI Enablement team. This role is responsible for managing and securing Legora's Apple-first endpoint fleet, ensuring devices are secure, automated, and healthy. The Endpoint Engineer will own the platform that transforms a new Mac into a secure, working laptop and maintains the health of every device. This position involves working across IT Systems, Workplace Technology, Information Security, and Engineering, and will define the endpoint roadmap.
Responsibilities
- Manage endpoint configuration as code, including authoring, reviewing, testing, and deploying macOS profiles, declarations, security baselines, and remediation scripts with built-in staging, canary groups, telemetry-based promotion, and rollback.
- Migrate from legacy payloads to declarative management as Apple retires MDM equivalents.
- Run MDM as a production service, focusing on configuration as code, observability, reliability, upgrades, and incident response.
- Lead platform evaluations and migrations for MDM tooling.
- Automate the device lifecycle, including zero-touch provisioning, declarative software update enforcement, software packaging and distribution, and secure deprovisioning.
- Own binary authorization, including policy model, rule distribution, application approvals, telemetry, and synchronization services.
- Build continuous posture evaluation for device health using real-time status subscriptions and automated remediation.
- Translate fleet telemetry into actionable decisions for dashboards, compliance reporting, and early warning systems.
- Develop AI-assisted operations by implementing agents and LLMs for repetitive tasks to scale reliability with the fleet.
- Define the endpoint roadmap by evaluating technologies, making architectural decisions, and resolving complex macOS and endpoint platform issues.
Requirements
- 8+ years of experience building and operating secure endpoint or IT systems in complex environments, including a large macOS fleet on a modern MDM.
- Experience owning the platform as the final escalation point with no senior endpoint engineer above.
- Proficiency in writing production-grade code, with Python as a minimum requirement; Swift or Go for endpoint tooling is a bonus.
- Treat endpoint configuration as software with tests, review, and observability.
- Demonstrated use of agents and LLMs to compress operational toil, with a clear understanding of their trustworthiness.
- Deep knowledge of macOS internals, including launchd, configuration profiles, TCC, system extensions, Endpoint Security, FileVault, Secure Token, and bootstrap tokens.
- Fluent in declarative device management and planning migrations from retiring payloads.
- Experience shipping endpoint changes through Git-based workflows with staging, canary, and rollback.
- A product-engineering mindset towards IT, focusing on reliability, observability, controlled change, and documentation.
- Ability to communicate technical architecture to technical stakeholders and explain changes to non-technical colleagues.