Senior Endpoint Engineer

WHO WE ARE
Apex Fintech Solutions (Apex) powers innovation and the future of digital wealth management by building tech-forward solutions that help simplify, automate, and facilitate access to financial markets for all. Our robust suite of fintech software enables us to support clients such as Stash, Betterment, SoFi, Webull, and eToro, amongst many others; collectively, Apex powers access to the stock market for over 22+ million end customers.
At Apex, we are changing how the securities industry operates by reinventing the status quo, which was manual, slow, and accessible only by the ultra-wealthy. We're digitizing and democratizing systems so that everyone has an opportunity to invest.
When you're at Apex, you drive this change. You're part of a global team with a clear vision: to be the trusted technology that powers the digital economy. Our offices in Austin, Dallas, Chicago, New York, Portland, Belfast, and Manila are home to over 1,000 employees.
Together, we’re shaping the future of financial innovation. Embrace change. Solve big. Win together. And be G.R.E.A.T. — grit, results, empathy, accountability, and teamwork — with Apex.
We’re proud to be recognized for the innovative work we do, the purpose-driven nature of our work, and the collaborative culture we’ve created. Here are just a few of the many awards we’ve recently received:
Best Places to Work
2026, 2025, 2024, 2023 - Presented by BuiltIn
WealthTech of the Year
2025 - Presented by US FinTech Awards
The World’s Top 250 Fintech Companies
2024 - Presented by CNBC
ABOUT THIS ROLE
About the Role
We're hiring a Senior Endpoint Engineer to own and evolve how our Windows and Mac devices are enrolled, configured, secured, patched, and retired. You'll be the technical lead for Microsoft Intune on Windows, Jamf Pro or Kandji with Apple Business Manager on macOS, and Entra ID Conditional Access or Okta to tie device trust to access.
This role is for someone who treats device management as software engineering. Every policy, profile, and script is written as code, reviewed in Git, rolled out in stages, and reversible. You'll bring new ideas, integrate our MDM, identity, and cloud systems, and replace manual work with automation.
What You'll Do
Lead endpoint platform engineering
Own Intune end to end: compliance, configuration profiles, Autopilot, app deployment, Scope Tags, and RBAC.
Manage the Apple lifecycle through Jamf Pro or Kandji and Apple Business Manager, including zero-touch enrollment and app deployment.
Design and enforce Conditional Access (Entra ID) and Okta device-trust policies with security and identity teams.
Ship policy as code
Ship MDM policy as code across macOS and Windows through a GitOps model (Terraform, Ansible, IntuneCD, or similar), with CI/CD, peer review, staged rollouts, and rollback.
Own managed browser and extension policy, keeping the control plane auditable.
Automate and integrate
Build integrations and automation across Intune, Jamf/Kandji, Entra ID, and cloud platforms using PowerShell, Python, Microsoft Graph, and services such as Azure Automation, Logic Apps, Azure Functions, or AWS Lambda.
Automate patching and third-party app updates to close exposure windows without disrupting employees.
Build dashboards, drift alerts, and AI-assisted automation from fleet telemetry to cut toil.
Secure and harden
Package and deploy apps (Win32, MSI, PKG/DMG) with detection, dependency, and rollback planning.
Partner with Information Security to remediate vulnerabilities and harden endpoints against CIS Benchmarks, mapped to NIST controls.
Lead and innovate
Serve as the escalation point for complex endpoint incidents, driving root-cause analysis and long-term fixes.
Set technical standards, document architecture decisions, and mentor engineers.
Evaluate new tools and apply AI to real operational problems to improve security, reliability, and user experience.
What We're Looking For
Required
Bachelor's degree in computer science or related technical discipline (or equivalent work experience) required.
6+ years in endpoint or systems engineering, with hands-on administration of both Microsoft Intune and an Apple MDM (Jamf Pro or Kandji).
Deep Intune expertise: compliance, configuration profiles, Autopilot, app protection, Scope Tags, and custom RBAC roles.
Strong Jamf Pro or Kandji experience: policies/Blueprints, configuration profiles, and zero-touch enrollment.
Apple Business Manager experience (automated enrollment, VPP, MDM server integration).
Proven policy-as-code and GitOps experience: infrastructure as code (Terraform modules and remote state, Bicep, Ansible, or CloudFormation) and CI pipelines (GitHub Actions, GitLab CI, Azure DevOps, or similar) with code review.
Strong automation background: PowerShell and Python, plus the Microsoft Graph API.
Strong Azure experience, including automation and integrations built on services such as Azure Automation, Logic Apps, and Azure Functions.
Entra ID administration (dynamic groups, app registrations, hybrid identity) and Conditional Access design in production. Okta experience a plus.
Vulnerability management and patching experience (Defender Vulnerability Management, Rapid7, Qualys, Patch My PC, Winget, or similar) and app packaging experience (PSADT, IntuneWin, PKG).
Solid grounding in Windows and macOS architecture, Kerberos, SAML, OAuth/OIDC, and certificate-based auth (SCEP/PKCS).
Strong documentation and communication skills, including the ability to explain tradeoffs to technical and non-technical audiences.
Nice to Have
AWS experience, including automation and integrations built on services such as Lambda, Step Functions, and EventBridge.
Experience using AI in production to solve operational problems.
Experience applying CIS Benchmarks and NIST frameworks (such as 800-53 or CSF) to endpoint compliance baselines.
Microsoft certifications (MD-102, SC-300, AZ-104, or AZ-500), Apple certifications, or cloud certifications (AWS, Azure).
ServiceNow or similar ITSM experience.
Work Environment
This job operates in a hybrid office environment three days per week.
​Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.
Our Rewards
We offer a robust package of employee perks and benefits, including healthcare benefits (medical, dental and vision, EAP), competitive PTO, 401k match, parental leave, and HSA contribution match. We also provide our employees with a paid subscription to the Calm app and offer generous external learning and tuition reimbursement benefits. At AFS, we offer a hybrid work schedule for most roles that allows employees to have the flexibility of working from home and one of our primary offices.
EEO Statement