{"id":54752,"url":"https://alion.io/job/thinking-machines-lab-endpoint-engineer-it","title":"Endpoint Engineer, IT","company":{"id":14382,"name":"Thinking Machines Lab","domain":"thinkingmachines.ai","url":"https://alion.io/company/thinking-machines-lab","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Support","role_family":"Support","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":260000,"max":360000,"currency":"USD","period":"year","gross":null,"usd_annual":360000},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Git","optional":false},{"name":"GitOps","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Zero Trust","optional":false},{"name":"API Gateway","optional":true},{"name":"AWS","optional":true},{"name":"AWS Lambda","optional":true},{"name":"Bootstrap","optional":true},{"name":"CI/CD","optional":true},{"name":"DynamoDB","optional":true},{"name":"JavaScript","optional":true},{"name":"osquery","optional":true},{"name":"Progressive Delivery","optional":true},{"name":"Python","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-08-04T17:55:52Z","employer_posted_date":"2026-08-04","last_verified_at":"2026-10-17T21:35:18Z","board_verified":true,"closed_at":null,"days_open":74,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":74},"description":"About Thinking Machines\nThe mission of Thinking Machines is to build AI that extends human will and judgment. We are training frontier models with Inkling, developing Tinker to let people make models their own, and crafting interfaces that broaden human-AI communication. We believe the future worth building is human, and we're hiring people who want to build it.\nAbout the Team\nThe IT team builds secure infrastructure and efficient processes that enable our employees to move quickly. We operate an all-Mac environment and manage our endpoint fleet as a distributed platform, applying production-engineering practices to device management and security.\nOur endpoint configurations, security policies, scripts, and software deployments are increasingly managed through version-controlled workflows with testing, review, staged rollouts, and rollback capabilities. This role will work closely with IT, Security, Identity, and Infrastructure to deliver a secure and reliable employee computing experience.\nWhat You’ll Do\nEndpoint Configuration as Code: Author, review, test, and progressively deploy macOS configuration profiles, security policies, queries, and remediation scripts. Build code review, staging, canary, validation, and rollback processes into endpoint changes.\n\nMDM Platform Engineering: Operate our MDM platform as a production service, including configuration as code, observability, upgrades, reliability, incident response, and integrations with other IT and Security systems.\n\nMDM Migration: Lead the evaluation, design, testing, and execution of our planned migration from Iru to Fleet. Establish functional requirements, identify configuration and security-control gaps, develop a phased migration plan, and move the fleet with minimal disruption to employees.\n\nSanta and Rudolph: Own the architecture and operation of Santa and its Rudolph synchronization service. Manage binary-authorization policies, rule distribution, application approvals, telemetry, observability, infrastructure, and incident response.\n\nZero Trust and Device Trust: Partner closely with Security and Identity to make device trust a core component of our Zero Trust architecture. Integrate endpoint posture signals into authentication, authorization, and conditional-access decisions.\n\nContinuous Posture Evaluation: Build systems that continuously evaluate device health and security posture, including MDM enrollment, OS version, patch status, disk encryption, endpoint protection, security-control status, and configuration compliance. Automatically identify and remediate drift or restrict access when a device no longer meets requirements.\n\nPatch Management: Build and maintain automated macOS patching workflows that support rapid enforcement timelines while providing a thoughtful employee experience.\n\nZero-Touch Provisioning: Design and improve Apple Business Manager and Automated Device Enrollment workflows that turn a new Mac into a secure, fully configured, and productive machine with minimal manual intervention.\n\nSoftware Distribution: Own application packaging, deployment, updating, and removal across the Mac fleet.\n\nFleet Telemetry and Compliance: Query live device state at scale and turn endpoint telemetry into actionable policies, dashboards, compliance reporting, and early warnings for configuration drift.\n\nAutomation: Build tools and AI-assisted workflows that reduce repetitive operational work and make endpoint management more reliable and scalable.\n\nEndpoint Security: Partner with Security on macOS hardening, binary authorization, vulnerability management, compliance controls, detection and response, and device-based access policies.\n\nAdvanced Troubleshooting: Serve as the escalation point for complex macOS and endpoint-platform issues that cannot be resolved through standard IT support processes.\n\nTechnical Leadership: Help define the endpoint roadmap, evaluate technologies, make architecture decisions, and lead complex initiatives from conception through production.\n\nBasic Qualifications\n8+ years of experience building and operating secure IT or endpoint systems in complex environments.\n\nExperience managing a large fleet of macOS devices through a modern MDM platform.\n\nExperience managing endpoint configuration through scripted deployments, Git-based workflows, or a full GitOps model.\n\nDeep knowledge of macOS internals, enterprise deployment, security controls, and troubleshooting.\n\nExperience designing and operating zero-touch Mac provisioning, patching, and software-distribution workflows.\n\nExperience using device health and security signals to evaluate endpoint compliance.\n\nExperience successfully delivering complex technical projects from conception through production.\n\nStrong ability to solve ambiguous problems involving multiple teams and stakeholders.\n\nAbility to communicate technical concepts clearly to technical and nontechnical audiences.\n\nA product-engineering mindset toward IT systems, including testing, observability, reliability, and controlled change management.\n\nA consistent practice of creating clear technical documentation, architecture diagrams, runbooks, and operational procedures.\n\nAbility to work from either our New York or San Francisco office.\n\nPreferred Qualifications\nFleet: Experience deploying, operating, or contributing to Fleet, including its MDM, osquery, GitOps, software-management, and vulnerability-management capabilities.\n\nMDM Migration: Experience leading a production MDM migration, particularly in an environment using Apple Business Manager and Automated Device Enrollment.\n\nIru: Experience managing macOS devices with Iru, formerly Kandji.\n\nSanta and Rudolph: Experience operating Santa at scale, including rule management, binary authorization, event telemetry, and a Rudolph synchronization service.\n\nZero Trust: Experience designing device-trust and continuous-posture-evaluation systems that integrate with identity providers, conditional access, or other Zero Trust controls.\n\nMDM as a Service: Experience operating an MDM or device-management platform as a production service rather than only administering a SaaS console.\n\nProgressive Delivery: Experience building automated endpoint rollout systems with staging, canary groups, rollback capabilities, and promotion decisions based on telemetry.\n\nOpen-Source Tooling: Experience deploying, operating, or contributing to open-source macOS endpoint-management or security tools.\n\nInfrastructure as Code: Experience managing endpoint or cloud infrastructure through Terraform or another infrastructure-as-code framework.\n\nCloud Infrastructure: Experience operating AWS services such as Lambda, API Gateway, DynamoDB, containers, managed databases, and monitoring systems.\n\nEndpoint Development: Proficiency in Swift or Go for building macOS endpoint tools, agents, or supporting services.\n\nAI-Assisted Operations: Experience using LLMs to automate operational work or a strong interest in applying them to endpoint engineering.\n\nTechnical Skills\nPython and shell scripting.\n\nmacOS internals, including launchd, configuration profiles, Transparency, Consent, and Control (TCC), system extensions, Endpoint Security, FileVault, Secure Token, and bootstrap tokens.\n\nApple Business Manager, Automated Device Enrollment, and Apple’s MDM and Declarative Device Management frameworks.\n\nModern Apple MDM platforms, particularly Iru, Fleet, Jamf, or equivalent.\n\nSanta binary authorization and Rudolph synchronization infrastructure.\n\nFleet-scale querying and osquery.\n\nGit, pull-request workflows, GitOps, and CI/CD for endpoint configuration.\n\nTerraform and infrastructure as code.\n\nPublic-cloud fundamentals, including serverless infrastructure, containers, managed databases, and monitoring.\n\nDevice lifecycle automation, including zero-touch enrollment, patching, software distribution, and secure deprovisioning.\n\nEndpoint security, Zero Trust, device trust, continuous posture evaluation, compliance, and automated remediation.\n\nLogistics\nLocation: This role is based in San Francisco, California or New York, New York.\n\nCompensation: Depending on background, skills and experience, the expected annual salary range for this position is $260,000 - $360,000.\n\nVisa sponsorship: We sponsor visas. While we can't guarantee success for every candidate or role, if you're the right fit, we're committed to working through the visa process together.\n\nBenefits: Thinking Machines offers generous health, dental, and vision benefits, unlimited PTO, paid parental leave, and relocation support as needed.\n\nAs set forth in Thinking Machines' Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.","description_format":"text","description_chars":8721,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Parental leave","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":true,"industries":["Multimodal AI","Foundation Models","AI Research Labs","AI Development Tools"],"lifecycle":[{"event":"open","at":"2026-08-04T17:55:52Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 30","filings_12m":30,"filings_prev_12m":8,"green_card_filings_12m":0,"median_offered_wage_usd":192500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":18,"band":"cold","label":"Long shot","p_open":1,"p_active":0.652,"p_room":0.28,"age_days":73,"expected_fill_days":29,"reasons":["conf:0","velocity","win:tail","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":360000,"is_top_pay":true},"html_url":"https://alion.io/job/thinking-machines-lab-endpoint-engineer-it","json_url":"https://alion.io/job/thinking-machines-lab-endpoint-engineer-it.json","meta":{"generated_at":"2026-10-18T00:47:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1373,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":14382},"rest":"https://alion.io/mcp/rest/get_company?id=14382"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fthinking-machines-lab-endpoint-engineer-it"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fthinking-machines-lab-endpoint-engineer-it"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fthinking-machines-lab-endpoint-engineer-it"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/thinking-machines-lab-endpoint-engineer-it\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fthinking-machines-lab-endpoint-engineer-it"}]}