MDM-Endpoint Engineer

KDInfotech is hiring an MDM/Endpoint Engineer to support and secure the full device lifecycle across a client’s organization. The role covers endpoint and mobile device management, provisioning, patching, security hardening, and support for devices in a regulated, validated-systems environment.

Responsibilities:

• Multi-OS device administration: Manage and support the endpoint fleet across macOS (Jamf Pro), Windows (FleetDM/PDQ), Linux, and Chrome devices, including enrollment, configuration profiles, and lifecycle management
• Apple Business Manager: Maintain ABM hygiene, including enrollment tokens, prestage/zero-touch enrollment, and removal of retired or e-wasted devices to prevent unauthorized re-enrollment
• Shared and lab devices: Support shared-use and lab instrument endpoints alongside standard user devices, coordinating maintenance windows with lab and facilities teams to minimize disruption
• OS upgrade cycles: Drive macOS upgrade adoption (e.g., Tahoe) through Jamf nudges and forced-update strategies for non-compliant devices
• Windows patching: Coordinate Windows 10/11 patching and ESU licensing, tracking machines by support status and closing gaps identified through fleet reporting
• Quarterly maintenance windows: Plan and execute rolling patch cycles for hard-to-schedule lab instruments and shared devices
• EDR and identity coordination: Monitor CrowdStrike agent health and Okta device trust/SSO status across the fleet; escalate gaps to InfoSec and remediate agent or enrollment failures
• Access hygiene: Administer and configure Okta/Active Directory for security and access management. Troubleshooting endpoint authentication using biometrics, hardware tokens, and certificates
• CMDB accuracy: Maintain accurate device and user records in Fresh Service, including primary device assignment, location, and lifecycle status, per documented SOPs
• Physical and remote audits: Execute recurring inventory audits (FTE, contractor, and lab device phases) combining in-person checks with automated compliance validation
• Ticket-based tracking: Log and track compliance exceptions (backup failures, check-in gaps, stale devices) as tickets rather than informal notes, to prevent lost follow-up
• Backup health: Monitor Druva (or equivalent) backup coverage and remediate gaps, including executive and VIP devices, contractors, and Linux endpoints
• Zero-touch onboarding: Maintain prestage enrollment and automated provisioning to minimize Helpdesk involvement in new-hire device setup
• Offboarding reliability: Support consistent, auditable offboarding, including device lock, data preservation, and asset recovery, for contractors and employees alike
• Scripting: Write and maintain scripts (Bash, Python, or PowerShell) and Jamf extension attributes/smart groups to automate compliance checks and reduce manual fleet management
• SOPs and knowledge sharing: Document standard operating procedures for fleet management, patching, and audits so processes are repeatable across sites and shifts
• Cross-team coordination: Partner with Helpdesk, InfoSec, Facilities, and site leads across Bay Area, San Diego, and Cambridge to align on device installs, vendor visits, and support escalations

Requirements:

• An ideal candidate is self-motivated and passionate about technology, and naturally curious
• We are looking for someone who enjoys taking an outside-the-box approach to unique problems and who understands the added rigor that comes with managing endpoints in an environment where data integrity, privacy, and compliance are non-negotiable
• Bachelor's degree in Computer Science, Information Technology, or equivalent hands-on experience
• 3+ years of hands-on endpoint or systems administration experience across macOS, Windows, and/or Linux in a professional environment
• Hands-on experience administering an MDM platform at scale (Jamf Pro required; exposure to FleetDM, PDQ, or Intune)
• Working knowledge of Okta for SSO and device trust
• Familiarity with an EDR/endpoint security tool such as CrowdStrike, and comfort collaborating with a security team on remediation
• Scripting proficiency in Bash, Python, or PowerShell for automating repetitive fleet tasks
• Experience with an ITSM/ticketing platform (Fresh Service, ServiceNow, or similar) and asset/CMDB tracking
• Strong communication skills and comfort working directly with end users, lab staff, and cross-functional stakeholders in a hybrid, multi-site organization
• Experience in early-stage companies or life sciences/research environments is a plus
• Experience managing Chrome/ChromeOS devices in an enterprise setting (Google Admin console)
• Familiarity with Apple Business Manager and zero-touch/prestage enrollment workflows
• Exposure to backup and disaster recovery tooling (Druva or similar) for endpoint fleets
• Experience supporting a life sciences, biotech, or other regulated research environment
• Familiarity with Zero Trust concepts and phishing-resistant authentication (e.g., WebAuthn/FIDO2)
• ITIL Foundation certification or equivalent service management experience
• Apple Certified Support Professional certification or equivalent