Urgent :: Mac Endpoint Engineer (macOS + Intune)

Position: Mac Endpoint Engineer (macOS + Intune)

Location: Onsite at the Downers Grove, IL office

Duration: 6+ Month Contract 

Visa  : NO H1B/CPT/OPT (EAD With Back Copy)

Description:

• 
  Location: Grant Thornton, Downers Grove, IL We are elevating macOS to first-class status and need a hands-on Mac Endpoint Engineer to build and harden a modern Intune-managed macOS environment. You will deliver zero-touch enrollment, seamless Platform SSO (PSSO) first sign-in, large-scale macOS app packaging, configuration, compliance, automation, and strong security posture. Goal: achieve 1:1 parity with Windows devices.Key Responsibilities
• Design/operate zero-touch enrollment with ABM + ADE (PreStage through post-enrollment fixes).
• Build consistent first sign-in experience using PSSO + Intune.
• Improve enrollment flows, bootstrap content, and post-enrollment automations.
• Lead macOS app packaging for Intune (PKG/DMG + pre/post scripts, detection rules, dependencies, retries, uninstall logic).
• Create scalable third-party app deployment model with staged rings, rollback plans, change control.
• Collaborate with Packaging/QA on versioning, testing, release notes.
• Manage Intune baseline configs & compliance policies; suggest UX/reliability improvements.
• Enforce CIS macOS benchmark controls (macOS 26+); own configuration/enforcement, partner with InfoSec.
• Integrate/support: Entra ID, Defender for Endpoint (DLP), CrowdStrike, CyberArk EPM, Qualys, GlobalProtect ZTNA.
• Automate via scripting (bash/zsh/Python; PowerShell for Graph) – provisioning, remediations, health checks, reporting.
• Deliver actionable Intune dashboard metrics (enrollment success, sign-in time, compliance drift, packaging SLAs).
• Write KB articles/how-tos; transfer knowledge to Support; provide occasional Tier 3 guidance (no on-call).
• Partner with Identity, Security, Networking, Support to prepare for go-live and scale across US users.
• Contribute to standards, guardrails, SOPs for long-term stability.

Environment

• MDM: Microsoft Intune only (no Jamf/Kandji).
• Minimum: macOS 26 (Tahoe).
• Stack: Entra ID, Defender for Endpoint, CrowdStrike, CyberArk EPM, Qualys, GlobalProtect.
• Standards: CIS macOS benchmark (InfoSec sets policy; you implement/operate).
• Tools: ABM + ADE in place; Intune for compliance & reporting.Required Qualifications
• 3–5+ years enterprise macOS MDM (Intune preferred).
• Strong Intune macOS packaging expertise (PKG/DMG, scripts, detection, rings, rollback).
• Hands-on ADE zero-touch + PSSO implementation.
• Scripting: bash/zsh/Python (PowerShell/Graph as needed).
• Experience enforcing CIS controls via Intune profiles/policies.
• Familiarity with Defender, CrowdStrike, CyberArk EPM, Qualys, GlobalProtect.
• Excellent documentation & knowledge-transfer skills.

Preferred

• Self-healing remediations / drift correction.
• iOS/iPadOS in Intune (bonus).
• Entra ID Conditional Access for macOS.
• Current Apple management trends (PSSO, macOS security/privacy).
• Success Looks Like
• Reliable zero-touch from unbox to desktop.
• Fast, frictionless PSSO sign-in.
• Scalable packaging/patching with SLAs, rings, rollback.
• Trusted CIS-aligned posture with clear Intune dashboards.