Systems Engineer - W2 Role

About This Role:

We’re looking for an experienced Systems Engineer to own management of our physical and virtual endpoint fleet: Macs, Chromebooks, iOS/Android devices, and Amazon WorkSpaces virtual desktops.

You’ll improve and automate how we deploy, secure, and patch devices, tie device posture into access decisions, and support SOC 2 compliance.

The ideal candidate has a passion for automation and for creating outstanding user experiences.

Hybrid in Minneapolis preferred; remote candidates considered.

Responsibilities

• Scale and support the existing fleet (500+ Macs, plus iOS and Android devices).
• Own administration of Gravie’s Jamf Cloud instance: MDM, declarative device management (DDM), VPP, smart groups, policies, scripts, packaging, and automated device enrollment.
• Support rollout of Apple Platform SSO.
• Use Okta Device Trust to control access to internal systems from managed and BYOD devices.
• Administer and automate Google endpoint management for BYOD Android devices and company-owned Chromebooks.
• Refine existing patch management workflows for macOS, iOS, and Android, using staged deployment rings, compliance targets, and reporting.
• Work with Security to monitor software installed on employee devices and automate blocking and removal of unnecessary or unapproved applications.
• Deploy and maintain required security agents, certificates, and network profiles across managed endpoints.
• Audit device health and inventory, and manage software and device licensing.
• Implement and document endpoint controls required for SOC 2 compliance and support audit evidence collection.
• Build Windows endpoint management for Amazon WorkSpaces virtual desktops from the ground up: evaluate and implement tooling, build and maintain images, and establish patching, configuration, and compliance baselines.
• Troubleshoot MDM enrollment, policy, and app deployment issues, and act as escalation point for end-user support.
• Create and maintain internal runbooks and end-user documentation.

Qualifications

• 3+ years of hands-on MDM experience across macOS and iOS, plus Android.
• Experience with endpoint security best practices (hardening, encryption, least privilege).
• Experience with declarative device management for macOS and iOS.
• Working knowledge of Jamf Pro/Cloud administration and Apple Business Manager.
• Familiarity with Google Workspace and Google endpoint management administration.
• Solid Git and scripting skills (bash/zsh/Python).
• Experience working with APIs for system interoperability.
• Ability to work independently and prioritize across competing operational and project work.

Nice to have

• Familiarity with HIPAA, SOC 2, or similar compliance frameworks.
• Okta Identity Engine and Okta Workflows experience.
• Experience with ZTNA and DLP solutions such as Netskope.
• Windows endpoint management (Intune or similar) and image management in VDI environments, such as Amazon WorkSpaces.
• Experience with ITSM tooling (Freshservice or similar) and automation of onboarding/offboarding workflows.
• Experience with the AWS Console.