{"id":55464,"url":"https://alion.io/job/legora-endpoint-engineer","title":"Endpoint Engineer","company":{"id":48110,"name":"Legora","domain":"legora.com","url":"https://alion.io/company/legora","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":86,"open_postings":77,"ghost_share":0,"stale_share":0.571,"repost_share":0,"time_to_fill_p50_days":50,"computed_at":"2026-09-26T05:45:00Z"}},"role":"Support","role_family":"Support","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":188000,"max":254000,"currency":"USD","period":"year","gross":null,"usd_annual":254000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Python","optional":false},{"name":"Bootstrap","optional":true},{"name":"Claude Code","optional":true},{"name":"Crowdstrike","optional":true},{"name":"DNS","optional":true},{"name":"Git","optional":true},{"name":"GitOps","optional":true},{"name":"ITSM","optional":true},{"name":"JavaScript","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Okta","optional":true},{"name":"osquery","optional":true},{"name":"Progressive Delivery","optional":true},{"name":"Terraform","optional":true},{"name":"VPN","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-07-31T17:09:54Z","employer_posted_date":"2026-07-31","last_verified_at":"2026-09-27T03:19:54Z","board_verified":true,"closed_at":null,"days_open":57,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":57},"description":"About Us\nLegora is redefining how legal work gets done. Not built for lawyers, built with them. We work alongside the world’s best legal teams, who expect excellence, precision, and speed, and we hold ourselves to the same bar.\nOur AI-native workspace lets legal professionals move faster, think more clearly, and operate with sharper precision. By analysing thousands of documents in minutes and powering end-to-end workflows, we cut through complexity, teams can focus on what matters: judgment, strategy, and outcomes.\n1,000+ customers across 50+ countries trust us, including Cleary Gottlieb, Goodwin, Linklaters, White & Case, Dentons, and Barclays. We’ve scaled to $100M+ in ARR, with teams across Europe, North America and APAC, and continue to expand through acquisitions including Qura, Walter AI and Graceview.\nWe partner with world-class performers: including Aaron Judge and the New York Yankees, Ludvig Åberg (and his caddie), and campaigns featuring Jude Law.\nJoining Legora means three things.\nWe lean in: ownership over titles, outcomes over intentions.\n\nWe fight for excellence: high standards, direct, ego-free feedback.\n\nWegrow together: as a team and with our customers.\n\nMission before ego. Everyone contributes. No one coasts.\nIf you’re driven by impact, pace, and raising the bar. This is the place.\nAbout the team\nThe IT and AI Enablement function exists to make Legora itself run as well as the product we sell: secure, automated, and compounding over time. We run an Apple-first fleet as a distributed platform: endpoint configuration, security policy, and software delivery move through version control with review, testing, staged rollout, and a way back. The Endpoint Engineer owns that platform: the machinery that turns a new Mac into a secure, working laptop and keeps every device in the fleet provably healthy. You’ll work across IT Systems, Workplace Technology, Information Security, and Engineering, and you’ll set the endpoint roadmap.\nWhat you’ll be doing\nManage endpoint configuration as code: author, review, test, and progressively deploy macOS profiles, declarations, security baselines, and remediation scripts, with staging, canary groups, telemetry-based promotion, and rollback built into every change. Own the migration from legacy payloads to declarative management as Apple retires the MDM equivalents.\n\nRun MDM as a production service: configuration as code, observability, reliability, upgrades, and incident response, plus the integrations that connect it to identity, security, and IT systems. Lead platform evaluations and migrations end to end when the tooling needs to change.\n\nAutomate the device lifecycle: zero-touch provisioning through Apple Business Manager and Automated Device Enrollment, declarative software update enforcement on timelines that hold without wrecking the employee experience, software packaging and distribution, and secure deprovisioning.\n\nOwn binary authorization: the policy model, rule distribution, application approvals, telemetry, and the synchronisation service behind it. Take a view on where macOS 27’s native binary allow/deny fits against a dedicated binary-authorization stack.\n\nBuild continuous posture evaluation: evaluate device health live (enrolment, OS and patch state, disk encryption, endpoint protection, control status, configuration drift) from real-time status subscriptions rather than polling, remediate automatically where you can, and produce the posture signal Corporate Security gates access on.\n\nTurn fleet telemetry into decisions: query device state at scale and drive it into dashboards, compliance reporting, and early warning on drift, feeding endpoint telemetry to Detection & Response for detection and incident work.\n\nBuild AI-assisted operations: put agents and LLMs on the repetitive operational work so reliability scales with the fleet. Anything manual twice a quarter gets automated.\n\nDefine the endpoint roadmap: evaluate technologies, make the architecture calls, and take on the macOS and endpoint-platform problems that standard support paths can’t resolve.\n\nWho you are\n8+ years building and operating secure endpoint or IT systems in complex environments, including a large macOS fleet on a modern MDM, owning the platform as the final escalation point, with no endpoint engineer above you to hand it to.\n\nA builder first: you write production-grade code (Python at least; Swift or Go for endpoint tooling is a bonus) and treat endpoint configuration as software you own, with tests, review, and observability, not a console you administer.\n\nAI-first by conviction: you already reach for agents and LLMs (Claude Code and the like) to compress operational toil, and you have a clear view on where they’re trustworthy and where a human owns the call. Show us something you automated that used to eat your week.\n\nDeep on macOS internals: launchd, configuration profiles, TCC, system extensions, Endpoint Security, FileVault, Secure Token and bootstrap tokens.\n\nFluent in declarative device management, not just profiles: you know where Apple has moved configuration to declarations and can plan a migration off the payloads being retired. Legacy software update management no longer functions in the 27 release, so declarative enforcement is the only supported path.\n\nDisciplined about change: you’ve shipped endpoint changes through Git-based workflows with staging, canary, and rollback, and you’d rather find a regression in a canary group than in the all-hands channel.\n\nA product-engineering mindset toward IT: reliability, observability, controlled change, and documentation others can operate from: architecture diagrams, runbooks, and decisions written down.\n\nClear with both audiences: you can take a technical stakeholder through the architecture and a non-technical colleague through what’s changing on their laptop and why.\n\nNice to have\nFleet: deploying, operating, or contributing to Fleet, including its MDM, osquery, GitOps, software-management, and vulnerability-management capabilities.\n\nLeading a production MDM migration, particularly with Apple Business Manager and Automated Device Enrollment in play.\n\nOperating Santa at scale: rule management, binary authorization policy, event telemetry, and a Rudolph synchronisation service.\n\nManaging macOS through Jamf or Kandji (now Iru), and Windows through Intune where the fleet calls for it.\n\nFleet-scale querying with osquery, and turning that data into compliance and drift reporting.\n\nDeclarative credentials: ACME, SCEP, and identity credentials declared once as reusable assets and referenced across network configurations, rather than embedded per profile.\n\nMoving network, VPN/DNS, extensible SSO, content caching, and web content filtering onto declarative configurations.\n\nOperating an MDM service against Apple’s stricter TLS and App Transport Security requirements.\n\nProgressive delivery for endpoints: automated rollout with staging, canary groups, telemetry-based promotion, and rollback.\n\nDevice trust and continuous posture evaluation integrated with an identity provider and conditional access.\n\nInfrastructure as code (Terraform or similar) and public-cloud fundamentals: serverless, containers, managed databases, monitoring.\n\nDeploying, operating, or contributing to open-source macOS endpoint management and security tooling.\n\nExperience with Okta, Microsoft Entra ID, 1Password, CrowdStrike, Jamf, Apple Business Manager, Lumos, and our AI-native ITSM (Serval).\n\nWhat’s In It For You\nGlobal collaboration: Partner with teams and clients across Europe, APAC, and North America.\n\nCompetitive package: Comprehensive salary, benefits, and tools for success.\n\nMeaningful work: Your efforts shape how thousands of lawyers use AI daily.\n\nIn-person environment: Union Square office designed for ambitious builders and company provided lunch daily.\n\nBenefits & Perks: We invest in our people with a comprehensive, thoughtfully designed benefits package: Medical, Dental & Vision\nMultiple medical plan options through Aetna and Kaiser Permanente\n\nHSA or Healthcare FSA (based on plan selection)\n\nDental plans via MetLife\n\nVision plans via Vision Care\n\nFamily Support\nGenerous parental leave\n\nFree access to Maven Clinic\n\nDependent Care FSA\n\nFree One Medical membership for employees and dependents\n\nAdditional Perks\nPre-tax commuter benefits\n\nLife Insurance + STD/LTD\n\n401(K) with generous company match\n\nUnlimited PTO\n\nRobust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more\n\nLegora is an Equal Opportunity Employer\nAt Legora, we believe great teams are built on diversity of thought and experience. We’re proud to be an equal opportunity employer and committed to creating an inclusive, high-performance culture where everyone can do their best work. We welcome people of all backgrounds and don’t discriminate based on race, color, religion, national origin, gender, gender identity or expression, sexual orientation, age, disability, veteran status, or any other characteristic protected by law.","description_format":"text","description_chars":9081,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance","Parental leave","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Document AI","Legal AI"],"lifecycle":[{"event":"open","at":"2026-07-31T17:09:54Z"},{"event":"open","at":"2026-09-05T08:57:41Z"}],"liveness":{"score":19,"band":"cold","label":"Long shot","p_open":1,"p_active":0.424,"p_room":0.44,"age_days":56,"expected_fill_days":50,"reasons":["conf:5","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-09-26T05:45:00Z"},"pay":{"stated_usd_annual":254000,"is_top_pay":true},"html_url":"https://alion.io/job/legora-endpoint-engineer","json_url":"https://alion.io/job/legora-endpoint-engineer.json","meta":{"generated_at":"2026-09-27T03:32:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":3318,"day_limit":5000,"remaining_today":1682,"minute_limit":60,"resets_at":"2026-09-28T00:00:00Z"}}}