Staff Jamf Engineer

LastPass is looking for a Staff Jamf Engineer:  

The Staff Jamf Engineer will serve as a strategic technical expert responsible for designing, implementing, and optimizing enterprise-level Apple device management solutions. Operating at a cross-functional level with key stakeholders in Security and Engineering, you will lead architecture discussions, influence endpoint strategy, and drive automation and scalability within the macOS and iOS ecosystem. 

The Cloud Operations & Endpoint team at LastPass is responsible for the reliability, security, and scalability of the organization’s corporate cloud infrastructure and identity platforms. This team manages critical services including Entra ID for identity and access management, Sailpoint for identity governance, and supports endpoint platforms, such as Intune and Jamf.  

The team operates at the intersection of infrastructure, security, and user experience, driving automation, policy enforcement, and operational excellence across the organization’s IT environment. 

If you are passionate about complex problem solving and motivated by scale, then this is the role for you!

Who will you work with?

Please note: While this position is remote, we prefer candidates who can work Eastern Time Zone hours to ensure alignment with business needs.

The Staff Jamf Engineer will partner closely with peers and stakeholders across the Security and Engineering organizations. They will: 

• Collaborate with Security teams to implement hardening baselines, enforce endpoint compliance policies, and support audit readiness through automated reporting and logging. 
• Work with Engineering teams to design scalable deployment frameworks that meet developer workflows, application packaging needs, and system configuration requirements. 
• Engage cross-functionally with Product, IT, and Compliance teams to align Jamf platform strategy with organizational goals. 

 What are some of the exciting challenges you will be working on?

• Lead and execute complex technical initiatives that have an organization-wide impact, with minimal oversight. 
• Serve as a subject matter expert and advisor across IT, Security, and Engineering teams. 
• Design and implement advanced configuration profiles, zero-touch deployment workflows, and scripting for macOS/iOS platforms. 
• Guide junior engineers and lead technical reviews. 
• Partner with security to ensure compliance, endpoint hardening, and audit readiness. 
• Recommend and influence long-term roadmaps for Apple fleet management with the enterprise. 
• Drive automation of device lifecycle management and compliance workflows using Jamf API, scripting, and cloud-native tools. 

What does it take to work at LastPass?

• Hands-on Jamf Pro administration in large-scale, global remote centric environments. 
• Strong experience using Jamf Pro API for automation and integration with external systems (e.g., ticketing, inventory, security tools) 
• Ability to translate security and compliance requirements into actionable device policies and enforcement mechanisms. 
• Expertise in Apple Business Manager (ABM) 
• Advanced scripting skills (e.g. Bash / Python) for automation, custom policies, and extension attributes. 
• Deep knowledge of configuration profiles, MDM frameworks, certificate management, and security baselines (CIS, NIST) 
• Proven experience designing and implementing zero-touch deployment workflows using Jamf and Apple tools. 
• Strong understanding of enterprise security integration, including identity management, endpoint detection, and compliance enforcement. 
• Experience with Jamf Connect, Platform SSO, and smart card authentication flows (including YubiKey integration) for macOS login and compliance enforcement 
• Experience using Jira for project management and task tracking, including Kanban workflows 
• Ability to create and maintain clear, concise documentation in Confluence 
• Jamf 200 certification  

It's great, but not required:

• Jamf 300 or 400 Certifications 
• Familiarity with Intune 
• iOS device management using Intune 
• Intune Conditional Access restriction  
• DevOps workflows or CI/CD pipelines