IT Client Engineer

Figure is an AI Robotics company developing a general-purpose humanoid robot for commercial and home use. This Client Engineer role owns Figure's endpoint fleet security and management across all operating sites—corporate campuses, factories, contract manufacturing partners, and field sites. The role combines endpoint engineering, identity and SSO management, and SaaS operations automation to protect the company's core robotic IP through technical controls on devices.

• Own zero-touch enrollment end-to-end across macOS, Windows, and Ubuntu LTS using Apple Business Manager, Windows Autopilot, and PXE provisioning
• Translate CIS Benchmarks into deterministic configuration profiles with osquery validations across all platforms
• Operate FleetDM as the cross-platform management agent and maintain standard, reproducible workstation builds with measured patch compliance
• Design and deploy hardened device configurations for factories and low-connectivity sites, including encryption, conditional access, and remote wipe capabilities
• Own SSO integration into Okta (SAML and OIDC) and design application authentication and RBAC; automate identity lifecycle provisioning, entitlement, and deprovisioning
• Build tooling in Python, Bash, or Power Shell to eliminate manual work across onboarding, offboarding, provisioning, and auditing; run license and access audits to recover costs
• Deploy and maintain Crowd Strike Falcon across the fleet in partnership with Security, and document standards, runbooks, and automation for the broader IT team

• Hands-on production experience managing macOS, Windows, and Ubuntu LTS endpoint fleets
• Practical experience with zero-touch enrollment and modern endpoint tooling:
  FleetDM or osquery-based management, Apple Business Manager, and Windows Autopilot or Microsoft Intune
• Strong scripting skills in Python, Bash, and/or Power Shell with a track record of replacing manual processes with code
• Working knowledge of authentication fundamentals: SAML, OIDC, SCIM and their tradeoffs; experience administering identity and SaaS platforms at scale (Okta, Google Workspace, Slack, Jira)
• Experience translating security benchmarks (CIS or similar) into enforced, validated configuration policy
• Sound judgment on security and risk tradeoffs and the ability to explain technical controls to non-technical stakeholders; detail-oriented and process-driven approach to documentation

• Experience supporting devices or users at manufacturing sites, contract manufacturers, or other high-IP-risk environments
• Familiarity with export control, data residency, or IP protection frameworks in hardware and software R&D
• Experience deploying or operating EDR agents at fleet scale such as Crowd Strike Falcon
• Experience building integrations against SaaS APIs and identity providers; supporting engineering workloads on Linux including workstation and build-host management; standing up IT capability at new sites or supporting international growth