Job description

Job Description: Our client is seeking an System and Security Engineer to join their team. This role owns the device and identity layer end to end. You'll administer the Windows, macOS, and iOS fleet day to day while leading the migration to a new MDM and endpoint security stack. Because you report to the CISO rather than to IT operations, security posture is the job, not a constraint on the job. Our environment is cloud-only. There are no domain controllers and no data center to visit, and the people you support are almost never in the same building you are. Some of what's deployed today stays and some gets replaced, and there are gaps nobody has filled yet. You'll make those calls alongside the CISO and then execute them. What you'll own: Microsoft 365 and Entra ID administration: identity lifecycle, conditional access policies, MFA enforcement, license management, Exchange Online, SharePoint, and Teams governance Windows endpoint management through Intune and Autopilot, including configuration profiles, compliance policies, and patch rings macOS administration and management, including hardware provisioning, FileVault enforcement, and OS update control iOS fleet administration in MaaS360 today, and the migration off it: cellular-enabled devices for field clinicians, supervised enrollment, app distribution, device recovery for departing staff Deployment and tuning of our new endpoint security platform, covering application allow-listing, temporary privilege elevation, controlled software updates, and EDR agent health Provisioning and deprovisioning workflows tied to HR events, with same-day access revocation on termination IT request queue in Zoho Desk, with escalation paths into Jira Service Desk for engineering-owned issues Evidence production for HITRUST, client security assessments, and payer audits: access reviews, asset inventory accuracy, patch compliance reporting, audit log retention Scripted automation of repetitive administration using PowerShell and the Microsoft Graph API Standing assessment of the current tool stack: recommending what to keep and what to replace, then running the vendor evaluation and rollout for anything new Device logistics for a workforce that is rarely in an office: zero-touch enrollment through Autopilot and Apple Business Manager so hardware ships from the vendor straight to the employee, plus spares inventory, device return and recovery on termination, and certified disposal of retired equipment First-year priorities: 1. Deliver a current-state assessment of the endpoint and identity stack in your first 90 days, with a ranked recommendation on what gets replaced and what gets added 2. Complete the MDM consolidation across Windows, macOS, and iOS, retiring MaaS360 with a verified device inventory on the other side 3. Deploy endpoint security agents to 100% of managed devices with allow-listing enforced and standing local admin rights eliminated 4. Get new-hire tech ready on or before day one, consistently, including field clinicians who never set foot in an office 5. Bring asset inventory to audit-grade accuracy so we can answer a client security questionnaire in hours instead of days Required qualifications: 7+ years administering Microsoft environments at scale, with current hands-on Entra ID and Intune experience Demonstrated macOS and iOS management experience in a mixed fleet. You are not a Windows admin who has occasionally touched a Mac. Direct experience executing an MDM migration or endpoint security rollout, including the messy parts: enrollment failures, user resistance, devices that never check in Working knowledge of conditional access, least-privilege access models, and endpoint hardening standards such as CIS Benchmarks Scripting proficiency in PowerShell; comfort with the Graph API Ability to write clearly for non-technical audiences, since your work becomes audit evidence Experience in a cloud-only environment with no on-premises domain controllers, where devices are Entra-joined rather than hybrid-joined and the user base is fully remote Judgment about tooling, not just operation of it. You can tell us when a product we already pay for is the wrong fit and defend the replacement. Preferred qualifications: Healthcare experience with hands-on HIPAA Security Rule application, or prior work supporting HITRUST certification Familiarity with MaaS360 specifically Experience supporting a remote clinical workforce across multiple time zones Jamf, Kandji, or equivalent Apple management platform experience Certifications: MD-102, AZ-104, SC-300, or Jamf 200/300 Salary/Rate: $50-$55/HR (depends on experience level). This is a contract position with candidates expected to work 40 hours/ week.

Requirements

Must-haves

Microsoft 365 and Entra ID administration: identity lifecycle, conditional access policies, MFA enforcement, license management, Exchange Online, SharePoint, and Teams governance
Windows endpoint management through Intune and Autopilot, including configuration profiles, compliance policies, and patch rings
macOS administration and management, including hardware provisioning, FileVault enforcement, and OS update control
iOS fleet administration in MaaS360 today, and the migration off it: cellular-enabled devices for field clinicians, supervised enrollment, app distribution, device recovery for departing staff
Deployment and tuning of our new endpoint security platform, covering application allow-listing, temporary privilege elevation, controlled software updates, and EDR agent health
Provisioning and deprovisioning workflows tied to HR events, with same-day access revocation on termination
IT request queue in Zoho Desk, with escalation paths into Jira Service Desk for engineering-owned issues
Evidence production for HITRUST, client security assessments, and payer audits: access reviews, asset inventory accuracy, patch compliance reporting, audit log retention
Scripted automation of repetitive administration using PowerShell and the Microsoft Graph API
Standing assessment of the current tool stack: recommending what to keep and what to replace, then running the vendor evaluation and rollout for anything new
Deliver a current-state assessment of the endpoint and identity stack in your first 90 days, with a ranked recommendation on what gets replaced and what gets added
Complete the MDM consolidation across Windows, macOS, and iOS, retiring MaaS360 with a verified device inventory on the other side
Deploy endpoint security agents to 100% of managed devices with allow-listing enforced and standing local admin rights eliminated
Get new-hire tech ready on or before day one, consistently, including field clinicians who never set foot in an office
Bring asset inventory to audit-grade accuracy so we can answer a client security questionnaire in hours instead of days
7+ years administering Microsoft environments at scale, with current hands-on Entra ID and Intune experience
Demonstrated macOS and iOS management experience in a mixed fleet. You are not a Windows admin who has occasionally touched a Mac.
Direct experience executing an MDM migration or endpoint security rollout, including the messy parts: enrollment failures, user resistance, devices that never check in

Nice-to-haves

Healthcare experience with hands-on HIPAA Security Rule application, or prior work supporting HITRUST certification
Familiarity with MaaS360 specifically
Experience supporting a remote clinical workforce across multiple time zones
Jamf, Kandji, or equivalent Apple management platform experience
Certifications: MD-102, AZ-104, SC-300, or Jamf 200/300
Salary/Rate: $50-$55/HR (depends on experience level). This is a contract position with candidates expected to work 40 hours/ week.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

jiraapi

Platform: careers-page
Effort: medium

Benefits

Benefits detected in the listing.

Vision