Thinking Machines Lab
Endpoint Engineer, IT
San Francisco · Senior
H1B sponsorship available$260k-$360kDetected 73 days ago
PythonSwiftCode ReviewGitDynamoDBAWSCloud PlatformsTerraformCI/CDPlatform EngineeringLLMsCybersecurityIncident ResponseLogisticsZero TrustLeadership
Stay score
odds of building a lasting career here
59Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role80
Entry-level history0
PERM / green-card track0
Lottery odds (Level IV)94
Fits your clock70
Sponsors, but it's cap-subject — you still face the weighted lottery (~61% per draw at Level IV). Good if you win; have a cap-exempt backup on your list.
Lottery odds assume a STEM candidate.
Personalize to your clock →H-1B wage level
the lottery is wage-weighted — each level is one more entry
Level I$137,0931 entry
Level II$165,1312 entries
Level III$193,1493 entries
Level IV$221,1874 entries
This range already reaches Level IV — the maximum four lottery entries.
DOL prevailing wage, 2026-27 wage year · Software Developers (15-1252) · San Francisco-Oakland-Fremont, CA. Wage level is derived by USCIS from the offered wage, occupation and worksite; the occupation shown is inferred from the job title.
Employer immigration record
from this employer's Department of Labor filings
Files H-1B transfers
16 transfer filings in the last year, covering 16 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.
Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.
Community outcomes
No reports yet — be the first to help the next applicant.
About the role
- Our endpoint configurations, security policies, scripts, and software deployments are increasingly managed through version-controlled workflows with testing, review, staged rollouts, and rollback capabilities.
Responsibilities
- Endpoint Configuration as Code: Author, review, test, and progressively deploy macOS configuration profiles, security policies, queries, and remediation scripts. Build code review, staging, canary, validation, and rollback processes into endpoint changes.
- MDM Migration: Lead the evaluation, design, testing, and execution of our planned migration from Iru to Fleet.
- Establish functional requirements, identify configuration and security-control gaps, develop a phased migration plan, and move the fleet with minimal disruption to employees.
- Santa and Rudolph: Own the architecture and operation of Santa and its Rudolph synchronization service. Manage binary-authorization policies, rule distribution, application approvals, telemetry, observability, infrastructure, and incident response.
- Zero Trust and Device Trust: Partner closely with Security and Identity to make device trust a core component of our Zero Trust architecture. Integrate endpoint posture signals into authentication, authorization, and conditional-access decisions.
- Patch Management: Build and maintain automated macOS patching workflows that support rapid enforcement timelines while providing a thoughtful employee experience.
- Zero-Touch Provisioning: Design and improve Apple Business Manager and Automated Device Enrollment workflows that turn a new Mac into a secure, fully configured, and productive machine with minimal manual intervention.
- Software Distribution: Own application packaging, deployment, updating, and removal across the Mac fleet.
- Automation: Build tools and AI-assisted workflows that reduce repetitive operational work and make endpoint management more reliable and scalable.
- Endpoint Security: Partner with Security on macOS hardening, binary authorization, vulnerability management, compliance controls, detection and response, and device-based access policies.
Requirements
- 8+ years of experience building and operating secure IT or endpoint systems in complex environments.
- Experience managing a large fleet of macOS devices through a modern MDM platform.
- Experience managing endpoint configuration through scripted deployments, Git-based workflows, or a full GitOps model.
- Deep knowledge of macOS internals, enterprise deployment, security controls, and troubleshooting.
- Experience designing and operating zero-touch Mac provisioning, patching, and software-distribution workflows.
- Experience successfully delivering complex technical projects from conception through production.
- Strong ability to solve ambiguous problems involving multiple teams and stakeholders.
- Ability to communicate technical concepts clearly to technical and nontechnical audiences.
- Ability to work from either our New York or San Francisco office.
Nice to have
- Fleet: Experience deploying, operating, or contributing to Fleet, including its MDM, osquery, GitOps, software-management, and vulnerability-management capabilities.
- MDM Migration: Experience leading a production MDM migration, particularly in an environment using Apple Business Manager and Automated Device Enrollment.
- Iru: Experience managing macOS devices with Iru, formerly Kandji.
- Santa and Rudolph: Experience operating Santa at scale, including rule management, binary authorization, event telemetry, and a Rudolph synchronization service.
- Zero Trust: Experience designing device-trust and continuous-posture-evaluation systems that integrate with identity providers, conditional access, or other Zero Trust controls.
- MDM as a Service: Experience operating an MDM or device-management platform as a production service rather than only administering a SaaS console.
- Open-Source Tooling: Experience deploying, operating, or contributing to open-source macOS endpoint-management or security tools.
- Infrastructure as Code: Experience managing endpoint or cloud infrastructure through Terraform or another infrastructure-as-code framework.
Skills
- Python and shell scripting.
- Apple Business Manager, Automated Device Enrollment, and Apple's MDM and Declarative Device Management frameworks.
- Modern Apple MDM platforms, particularly Iru, Fleet, Jamf, or equivalent.
- Santa binary authorization and Rudolph synchronization infrastructure.
- Fleet-scale querying and osquery.
- Git, pull-request workflows, GitOps, and CI/CD for endpoint configuration.
- Terraform and infrastructure as code.
- Public-cloud fundamentals, including serverless infrastructure, containers, managed databases, and monitoring.
- Device lifecycle automation, including zero-touch enrollment, patching, software distribution, and secure deprovisioning.
- Endpoint security, Zero Trust, device trust, continuous posture evaluation, compliance, and automated remediation.
- Compensation: Depending on background, skills and experience, the expected annual salary range for this position is $260,000 - $360,000.
Compensation
- Depending on background, skills and experience, the expected annual salary range for this position is $260,000 - $360,000.
Benefits
- Thinking Machines offers generous health, dental, and vision benefits, unlimited PTO, paid parental leave, and relocation support as needed.
Company info
- The IT team builds secure infrastructure and efficient processes that enable our employees to move quickly.
- We operate an all-Mac environment and manage our endpoint fleet as a distributed platform, applying production-engineering practices to device management and security.
- This role will work closely with IT, Security, Identity, and Infrastructure to deliver a secure and reliable employee computing experience.
Visa & Work Authorization
- We sponsor visas.
- While we can't guarantee success for every candidate or role, if you're the right fit, we're committed to working through the visa process together.
Apply directly at Thinking Machines Lab →Create a free account for alerts like thisView Thinking Machines Lab immigration profile
This listing is sourced directly from Thinking Machines Lab's careers page and normalized into a canonical job model.