MacOS Endpoint Engineer

Job description

Overview:

Grant Thornton is expanding macOS as a first-class platform and looking for a Mac Endpoint Engineer to build and harden a modern, Intune managed Mac environment.You’ll deliver zero touch enrollment and a consistent, repeatable first sign in experience with Platform SSO (PSSO), and lead macOS application packaging for Intune at scale.This is a hands-on engineering role focused on stability, repeatability, and future ready automation.Responsibilities:

Zero touch onboarding & first sign in

Design, standardize, and operate zero touch enrollment with Apple Business Manager (ABM) + Automated Device Enrollment (ADE)—from PreStage to post enrollment remediations.Establish a predictable first sign in flow leveraging PSSO and Intune so every new Mac enrolls, configures, and signs in the same way every time.Continuously identify improvements to enrollment flows, bootstrap content, and post enrollment automations.macOS application packaging for Intune

Lead macOS packaging for Intune (PKG/DMG with pre/post install scripts), including detection rules, dependencies, retries, and uninstallers.Build a sustainable approach for third party apps at scale (staged rings, rollback plans, and change control).Partner with App Packaging and QA to standardize versioning, testing, and release notes.Configuration, compliance & security posture

Operate within established baseline configuration and compliance policies in Intune; propose optimizations where they improve reliability or user experience.Implement and maintain controls aligned to the CIS benchmark for macOS; partner with InfoSec (policy owners) while owning configuration and enforcement.Integrate and support endpoint/security agents and posture: Entra ID, Defender for Endpoint (DLP), CrowdStrike, CyberArk EPM, Qualys, and GlobalProtect ZTNA.Automation, observability & documentation

Use scripting (choose the right tool for macOS—e.g., bash/zsh/Python/PowerShell for Graph) to automate provisioning, remediations, health checks, and reporting.Leverage Intune compliance dashboards to publish actionable metrics (enrollment success, first sign in duration, compliance drift, packaging SLA).Produce clear KB/how to articles and contribute to knowledge transfer with Support Services; provide periodic Tier 3 guidance (no on call).Collaboration & scale up

Work with Identity, Security, Networking, and Support to ready the platform for go live and scale beyond the initial fleet.Provide feedback on standards, guardrails, and SOPs to ensure stability as adoption grows across the US user base.Environment you’ll step into:

Long term goal is to offer Mac at 1:1 parity with Windows devices.MDM: Microsoft Intune only (no Jamf/Kandji in scope); minimum supported macOS version: 26.Identity & Security: Entra ID, Defender for Endpoint (DLP), CrowdStrike, CyberArk EPM, Qualys, GlobalProtect ZTNA.Standards: CIS macOS benchmark—InfoSec dictates policies; you own configuration and operational enforcement.Tooling: ABM + ADE in place; Intune for compliance dashboards and reporting.Qualifications:

3–5 years of enterprise macOS MDM management (e.g., Intune, Jamf, or other Apple focused MDMs).Demonstrated expertise in macOS app packaging for Intune (PKG/DMG, scripts, detection/uninstall logic, rings, rollback).Strong zero touch/ADE experience and hands on PSSO implementation for first sign in.Practical scripting for macOS engineering (bash/zsh/Python/PowerShell for Graph as applicable).Proven experience enforcing controls aligned to CIS macOS with Intune configuration/compliance policies.Familiarity with enterprise security agents and posture tooling: Defender for Endpoint, CrowdStrike, CyberArk EPM, Qualys, GlobalProtect.Excellent documentation skills; ability to produce KB/how tos and perform knowledge transfer to Support.Preferred Qualifications:

Experience building repeatable, self-healing remediations (post enrollment, drift correction, telemetry driven fixes).iOS/iPadOS management exposure (Intune/ABM/VPP)—bonus only; role remains macOS focused.Familiarity with Conditional Access integrations for macOS via Entra ID.Awareness of Apple management trends (e.g., evolving PSSO support, modern macOS security/privacy controls).What success looks like:

Consistent, stable zero touch from OOBE to first desktop—every time.Delightful first sign in with PSSO, measured by reduced time to productivity and few/no manual steps.Packaging/patching at scale with clear SLAs, staged rings, and rollback plans.CIS aligned device posture with intuitive, trustworthy Intune dashboards for leadership and Support.Interview Process:

30 minute technical interview with Manager30 minute interview with Director