SME - Desk Side Services, AMT Asset Management Software

Job Summary We are looking for a senior (L3) macOS engineer to take an Intune-managed Mac fleet from \"enrolled and working\" to a properly engineered, largely automated platform. The work is project-based with a clear scope: automated app packaging, a better enrollment experience, standard-user enforcement with just-in-time admin rights, data protection on the device, governance around Apple-specific features (Activation Lock, Find My, Apple IDs), and a macOS beta program. You will own the technical design and delivery end to end. That means building the tooling, writing the scripts and documentation, running the pilot and handover, and being the last line of escalation for anything Mac-related while the project runs. The stack is deliberately open-source first: AutoPkg with Intune Uploader for packaging, swiftDialog and Octory for the user-facing enrollment flow, and SAP\'s Privileges app for admin rights. You should be comfortable living in GitHub, reading other people\'s code, and contributing fixes upstream when something breaks. Key Responsibilities Key responsibilities Automated application packaging • Stand up and operate an AutoPkg pipeline with Intune Uploader so third-party apps are built, versioned and published to Intune without manual packaging. • Bring roughly 25 applications into the pipeline (the list may shrink after analysis), including recipe overrides, pre/post-install logic, and detection rules. • Document the pipeline so the run team can add an app or chase a failed build without you. Enrollment experience • Finetune the existing enrollment flow built on swiftDialog and Octory, including status screens, app installation ordering, and failure handling. • Implement managed local account creation during enrollment. • Define and document the process for devices that are not in Apple Business Manager, with the available options and their trade-offs. Admin rights and privilege management • Enforce standard user accounts across the fleet and remove persistent admin rights. • Deploy SAP Privileges for time-boxed, self-service admin elevation, with logging. • Write and operate the exception governance process for users who need standing admin rights. • Finetune the existing LAPS implementation. Data protection and device lifecycle • Configure OneDrive Known Folder Move (the macOS equivalent) so Desktop and Documents are backed up automatically. • Build backup compliance monitoring and reporting on top of it. • Automate user data migration for device refresh scenarios. • Create the Activation Lock bypass workflow for corporate-owned devices. • Define the governance process for disabling and re-enabling Find My Mac. Identity and Apple services • Finetune Platform SSO against Entra ID. • Design and run the migration from personal Apple IDs to Managed Apple IDs, including comms and the user-facing steps. macOS beta program • Enable macOS beta enrollment through Intune for a test ring, run the testing cycle, and document the process so it repeats each year. Compliance and reporting • Define the compliance metrics that matter for this fleet and build the dashboard that shows them. Across all of the above • Act as the L3 escalation point for macOS incidents and problems during the engagement. • Hand over clean documentation, runbooks and knowledge transfer sessions to the L2 team. Skill Requirements Required skills and experience • 5+ years managing macOS in an enterprise environment, with at least 2 of them hands-on with Microsoft Intune as the MDM for Mac (configuration profiles, shell scripts, app deployment, compliance policies, device enrollment). • Apple Business Manager and Automated Device Enrollment, including what to do when a device is not in ABM. • Production experience with AutoPkg: writing and overriding recipes, running it in a scheduled or CI context, and troubleshooting broken downloads and trust issues. Experience with Intune Uploader or a comparable upload processor. • Hands-on with swiftDialog for user-facing enrollment and notification flows; experience with Octory or a similar onboarding tool. • Deploying and operating SAP Privileges (or an equivalent such as Jamf Connect elevation or a custom solution) in a standard-user fleet. • Strong shell scripting (zsh/bash) and comfort with Python for packaging automation; Git and GitHub as a daily tool. • Working knowledge of macOS security internals: FileVault, Activation Lock, Find My, Secure Token and Bootstrap Token, PPPC and system extensions, local account types. • Microsoft 365 on the Mac: OneDrive (Known Folder Move / Desktop and Documents sync), Platform SSO with Entra ID, macOS LAPS. • Able to write documentation and runbooks that an L2 team can actually follow, and to run a knowledge transfer. • Fluent English (the engagement is run in English). Must Have Skill Desk Side Services,Hardware Asset Management,Hardware Mgmt - Printers,MAC Hardware Mgmt,Windows PC,AMT Asset Management Software Good to Have Skill Other Requirements Nice to have • Managed Apple ID and federation experience (Entra ID or Google) and a past personal-tomanaged Apple ID migration. • Experience running a macOS beta or early-adopter program. • Compliance reporting experience: building dashboards from Intune or Graph API data (Power BI, Log Analytics, or similar). • Jamf Pro or Fleet background, which helps when translating well-known Mac admin patterns into Intune. • Contributions to any of the open-source projects in the stack, or active participation in the MacAdmins community. • Swift or Objective-C basics, for reading tool source when debugging. What success looks like By the end of the engagement the fleet should look like this: Area Deliverable Packaging AutoPkg + Intune Uploader pipeline running on a schedule, ~25 apps onboarded, documented so L2 can extend it Enrollment Refined swiftDialog/Octory flow in production, managed local account created at enrollment, non-ABM process documented Admin rights All users on standard accounts, Privileges deployed for JIT elevation, exception process live with an owner Data protection Known Folder Move enforced, backup compliance report available, data migration automation tested on a device refresh Apple governance Activation Lock bypass workflow and Find My Mac process signed off by security Identity Platform SSO finetuned, Managed Apple ID migration plan approved and at least piloted Beta program Test ring enrolled, first beta cycle completed, repeatable process documented Reporting Compliance dashboard in use by the service owner Handover Runbooks and KT sessions completed, no open L3 dependencies on the leaving engineer Engagement details Level L3 / Senior macOS Engineer Engagement type Project-based B2B Duration 6 months Location / time zone Remote, European working hours Reports to Mac platform lead