Endpoint Engineer

ABOUT US Legora is redefining how legal work gets done. Not built for lawyers, built with them. We work alongside the world’s best legal teams, who expect excellence, precision, and speed, and we hold ourselves to the same bar. Our AI-native workspace lets legal professionals move faster, think more clearly, and operate with sharper precision. By analysing thousands of documents in minutes and powering end-to-end workflows, we cut through complexity, teams can focus on what matters: judgment, strategy, and outcomes. 1,000+ customers across 50+ countries trust us, including Cleary Gottlieb, Goodwin, Linklaters, White & Case, Dentons, and Barclays. We’ve scaled to $100M+ in ARR, with teams across Europe, North America and APAC, and continue to expand through acquisitions including Qura, Walter AI and Graceview. We partner with world-class performers: including Aaron Judge and the New York Yankees, Ludvig Åberg (and his caddie), and campaigns featuring Jude Law. Joining Legora means three things. - We lean in: ownership over titles, outcomes over intentions. - We fight for excellence: high standards, direct, ego-free feedback. - We grow together: as a team and with our customers. Mission before ego. Everyone contributes. No one coasts. If you’re driven by impact, pace, and raising the bar. This is the place. ABOUT THE TEAM The IT and AI Enablement function exists to make Legora itself run as well as the product we sell: secure, automated, and compounding over time. We run an Apple-first fleet as a distributed platform: endpoint configuration, security policy, and software delivery move through version control with review, testing, staged rollout, and a way back. The Endpoint Engineer owns that platform: the machinery that turns a new Mac into a secure, working laptop and keeps every device in the fleet provably healthy. You’ll work across IT Systems, Workplace Technology, Information Security, and Engineering, and you’ll set the endpoint roadmap. WHAT YOU’LL BE DOING - Manage endpoint configuration as code: author, review, test, and progressively deploy macOS profiles, declarations, security baselines, and remediation scripts, with staging, canary groups, telemetry-based promotion, and rollback built into every change. Own the migration from legacy payloads to declarative management as Apple retires the MDM equivalents. - Run MDM as a production service: configuration as code, observability, reliability, upgrades, and incident response, plus the integrations that connect it to identity, security, and IT systems. Lead platform evaluations and migrations end to end when the tooling needs to change. - Automate the device lifecycle: zero-touch provisioning through Apple Business Manager and Automated Device Enrollment, declarative software update enforcement on timelines that hold without wrecking the employee experience, software packaging and distribution, and secure deprovisioning. - Own binary authorization: the policy model, rule distribution, application approvals, telemetry, and the synchronisation service behind it. Take a view on where macOS 27’s native binary allow/deny fits against a dedicated binary-authorization stack. - Build continuous posture evaluation: evaluate device health live (enrolment, OS and patch state, disk encryption, endpoint protection, control status, configuration drift) from real-time status subscriptions rather than polling, remediate automatically where you can, and produce the posture signal Corporate Security gates access on. - Turn fleet telemetry into decisions: query device state at scale and drive it into dashboards, compliance reporting, and early warning on drift, feeding endpoint telemetry to Detection & Response for detection and incident work. - Build AI-assisted operations: put agents and LLMs on the repetitive operational work so reliability scales with the fleet. Anything manual twice a quarter gets automated. - Define the endpoint roadmap: evaluate technologies, make the architecture…