{"id":237756,"url":"https://alion.io/job/figure-ai-it-client-engineer","title":"IT Client Engineer","company":{"id":25,"name":"Figure AI","domain":"figure.ai","url":"https://alion.io/company/figure-ai","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":85,"open_postings":95,"ghost_share":0.168,"stale_share":0,"repost_share":0.021,"time_to_fill_p50_days":174,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Support","role_family":"Support","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Jose, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":150000,"max":200000,"currency":"USD","period":"year","gross":null,"usd_annual":200000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"CIS Benchmarks","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Google Workspace","optional":false},{"name":"Jira","optional":false},{"name":"Linux","optional":false},{"name":"Okta","optional":false},{"name":"osquery","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Slack","optional":false},{"name":"Ubuntu","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-01T19:44:54Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-11-01T03:14:44Z","board_verified":true,"closed_at":null,"days_open":60,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":59},"description":"Figure is an AI robotics company developing autonomous general-purpose humanoid robots. The goal of the company is to ship humanoid robots with human level intelligence. Its robots are engineered to perform a variety of tasks in the home and commercial markets. Figure is headquartered in San Jose, CA.\nWe are looking for a Client Engineer to own Figure's endpoint fleet everywhere it operates: our San Jose campus, our factories, our contract manufacturing partners, and connectivity-challenged field sites. Figure's most valuable asset is the design and software behind our humanoid, and this role is the technical owner of the controls that keep that IP on the devices, in the environments, and in the hands we intend. You will work closely with our Information Security team to define how devices are issued, hardened, monitored, and recovered; what data is allowed to land on them; and how quickly we can detect and cut off exposure when something goes wrong, whether the device sits on the corporate network or offline on a factory floor.\nYou are also the technical lead for client-side infrastructure company-wide. You will run endpoint management across macOS, Windows 11 Pro, and Ubuntu LTS, own SSO integration and identity lifecycle automation on Okta, and replace manual IT work with code. The ideal candidate is an engineer first and a systems administrator second: someone who responds to a repeated ticket by writing the script that eliminates it, documents the result, and is comfortable owning a security-sensitive program with real business consequences.\nResponsibilities:\nEndpoint Engineering\nOwn zero-touch enrollment end to end: Apple Business Manager for macOS, Windows Autopilot for Windows, and PXE provisioning for Ubuntu workstations.\n\nTranslate CIS Benchmarks into deployable configuration profiles across all platforms: deterministically applied settings accompanied with osquery validations to validate posture.\n\nOperate FleetDM as the cross-platform management agent across macOS, Windows, and Ubuntu LTS.\n\nMaintain standard, reproducible workstation builds with measured and enforced patch compliance.\n\nBuild hardened device configurations for factories, contract manufacturers, and low-connectivity sites: loaner and clean-device programs, encryption enforcement and escrow, conditional access, and remote wipe and recovery.\n\nDeploy and maintain CrowdStrike Falcon coverage across the fleet in partnership with Security, closing gaps on unmanaged or drifted devices.\n\nTranslate data handling and IP protection requirements from Security, Legal, and Engineering leadership into enforceable technical controls.\n\nIdentity and SSO Engineering\nOwn SSO integration of applications into Okta (SAML and OIDC), including internal tools with no vendor documentation.\n\nDesign application authentication and RBAC from first principles, in coordination with Security.\n\nAutomate the identity lifecycle end to end: provisioning, entitlement, and deprovisioning driven by Okta Workflows and integrated with Google Workspace, Slack, and Jira.\n\nSaaS Operations and Automation\nBuild tooling in Python, Bash, or PowerShell to eliminate manual work across onboarding, offboarding, provisioning, reporting, and audit.\n\nRun license and access audits, surface inactive accounts and orphaned entitlements, and drive cost recovery with Procurement.\n\nFormalize change management for endpoint and SaaS changes and participate in the Change Advisory Board.\n\nDocument standards, runbooks, and automation so the broader IT team can operate and extend what you build.\n\nAct as escalation point for complex client-side issues and mentor Operations Specialists.\n\nRequirements:\nHands-on experience managing macOS, Windows, and Linux (Ubuntu LTS) endpoint fleets in production.\n\nPractical experience with zero-touch enrollment and modern endpoint tooling: FleetDM or comparable osquery-based management, Apple Business Manager, Windows Autopilot or Microsoft Intune.\n\nExperience turning security benchmarks (CIS or similar) into enforced, validated configuration policy.\n\nStrong scripting skills in Python, Bash, and/or PowerShell, with a track record of replacing manual processes with code.\n\nWorking knowledge of authentication fundamentals: SAML, OIDC, SCIM, and the tradeoffs between them.\n\nExperience administering identity and SaaS platforms at scale: Okta, Google Workspace, Slack, Jira, including SCIM and API-driven provisioning.\n\nSound judgment on security and risk tradeoffs, and the ability to explain technical controls to non-technical stakeholders.\n\nDetail-oriented and process-driven, particularly in documenting standards and policy.\n\nGreat communication, collaboration, and interpersonal skills.\n\nBonus Qualifications:\nExperience supporting devices or users at manufacturing sites, contract manufacturers, or other high-IP-risk environments.\n\nFamiliarity with export control, data residency, or IP protection frameworks in hardware and software R&D.\n\nExperience with employee-built AI applications: assess authentication and permissions risk, and redirect requests to a Security consult.\n\nExperience deploying or operating EDR agents at fleet scale (CrowdStrike Falcon or similar).\n\nExperience building integrations against SaaS APIs and identity providers.\n\nExperience supporting engineering workloads on Linux, including workstation and build-host management.\n\nExperience standing up IT capability at new sites, or supporting international growth remotely from a central location.\n\nThe US base salary range for this full-time position is $150,000 to $200,000 per year.\nThe pay offered for this position may vary based on several individual factors, including job-related knowledge, skills, and experience. The total compensation package may also include additional components/benefits depending on the specific role. This information will be shared if an employment offer is extended.","description_format":"text","description_chars":5899,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Robotics AI","Humanoid Robots","Multimodal AI"],"lifecycle":[{"event":"open","at":"2026-09-05T10:12:44Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 23","filings_12m":23,"filings_prev_12m":23,"green_card_filings_12m":0,"median_offered_wage_usd":227500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":85,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.853,"p_room":1,"age_days":59,"expected_fill_days":174,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-31T05:58:55Z"},"pay":{"stated_usd_annual":200000,"is_top_pay":true},"html_url":"https://alion.io/job/figure-ai-it-client-engineer","json_url":"https://alion.io/job/figure-ai-it-client-engineer.json","meta":{"generated_at":"2026-11-01T03:42:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5791,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":25},"rest":"https://alion.io/mcp/rest/get_company?id=25"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffigure-ai-it-client-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffigure-ai-it-client-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffigure-ai-it-client-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/figure-ai-it-client-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffigure-ai-it-client-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":237756}},{"tool":"search_jobs","arguments":{"company":"figure.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":237756},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}