Endpoint Engineer (macOS)

Location: On-site in New York City (Union Square)

Salary: $216K – $254K + Equity

Company

Legora is an AI-native workspace for legal professionals, scaling to $100M+ ARR and serving over 1,000 customers globally.

What you will do

• Manage endpoint configuration as code, authoring and deploying macOS profiles and security baselines via Git-based workflows.
• Operate MDM as a production service with a focus on observability, reliability, and identity system integration.
• Automate the device lifecycle using Apple Business Manager and Automated Device Enrollment for zero-touch provisioning.
• Implement binary authorization policies, rule distribution, and telemetry synchronization.
• Develop continuous posture evaluation to monitor device health and gate Corporate Security access.
• Integrate AI agents and LLMs to automate repetitive operational tasks and scale reliability.

Requirements

• 8+ years of experience operating secure endpoint or IT systems in complex macOS environments.
• Proficiency in writing production-grade code in Python; Swift or Go is a bonus.
• Deep knowledge of macOS internals (launchd, TCC, system extensions, FileVault).
• Experience with declarative device management and Git-based workflows (staging, canary, rollback).
• Must be based in New York City for on-site work.
• Product-engineering mindset with a focus on reliability, observability, and documentation.

Nice to have

• Experience deploying and contributing to Fleet (MDM, osquery, GitOps).
• Experience operating Santa at scale for binary authorization.
• Management of macOS via Jamf or Kandji, and Windows via Intune.
• Knowledge of Infrastructure as Code (Terraform) and public cloud fundamentals.
• Experience with Okta, CrowdStrike, 1Password, and Apple Business Manager.

Culture & Benefits

• Comprehensive medical, dental, and vision plans via Aetna, Kaiser Permanente, and MetLife.
• Family support including generous parental leave and free Maven Clinic access.
• 401(k) with generous company match and unlimited PTO.
• In-person culture at the Union Square office with daily provided lunch.
• Pre-tax commuter benefits and identity protection via Aura.