Job Description:

Our client is seeking an System and Security Engineer to join their team. This role owns the device and identity layer end to end. You'll administer the Windows, macOS, and iOS fleet day to day while leading the migration to a new MDM and endpoint security stack. Because you report to the CISO rather than to IT operations, security posture is the job, not a constraint on the job.

Our environment is cloud-only. There are no domain controllers and no data center to visit, and the people you support are almost never in the same building you are. Some of what's deployed today stays and some gets replaced, and there are gaps nobody has filled yet. You'll make those calls alongside the CISO and then execute them.

What you'll own:

• Microsoft 365 and Entra ID administration: identity lifecycle, conditional access policies, MFA enforcement, license management, Exchange Online, SharePoint, and Teams governance
• Windows endpoint management through Intune and Autopilot, including configuration profiles, compliance policies, and patch rings
• macOS administration and management, including hardware provisioning, FileVault enforcement, and OS update control
• iOS fleet administration in MaaS360 today, and the migration off it: cellular-enabled devices for field clinicians, supervised enrollment, app distribution, device recovery for departing staff
• Deployment and tuning of our new endpoint security platform, covering application allow-listing, temporary privilege elevation, controlled software updates, and EDR agent health
• Provisioning and deprovisioning workflows tied to HR events, with same-day access revocation on termination
• IT request queue in Zoho Desk, with escalation paths into Jira Service Desk for engineering-owned issues
• Evidence production for HITRUST, client security assessments, and payer audits: access reviews, asset inventory accuracy, patch compliance reporting, audit log retention
• Scripted automation of repetitive administration using PowerShell and the Microsoft Graph API
• Standing assessment of the current tool stack: recommending what to keep and what to replace, then running the vendor evaluation and rollout for anything new
• Device logistics for a workforce that is rarely in an office: zero-touch enrollment through Autopilot and Apple Business Manager so hardware ships from the vendor straight to the employee, plus spares inventory, device return and recovery on termination, and certified disposal of retired equipment

First-year priorities:

1. Deliver a current-state assessment of the endpoint and identity stack in your first 90 days, with a ranked recommendation on what gets replaced and what gets added

2. Complete the MDM consolidation across Windows, macOS, and iOS, retiring MaaS360 with a verified device inventory on the other side

3. Deploy endpoint security agents to 100% of managed devices with allow-listing enforced and standing local admin rights eliminated

4. Get new-hire tech ready on or before day one, consistently, including field clinicians who never set foot in an office

5. Bring asset inventory to audit-grade accuracy so we can answer a client security questionnaire in hours instead of days

Required qualifications:

• 7+ years administering Microsoft environments at scale, with current hands-on Entra ID and Intune experience
• Demonstrated macOS and iOS management experience in a mixed fleet. You are not a Windows admin who has occasionally touched a Mac.
• Direct experience executing an MDM migration or endpoint security rollout, including the messy parts: enrollment failures, user resistance, devices that never check in
• Working knowledge of conditional access, least-privilege access models, and endpoint hardening standards such as CIS Benchmarks
• Scripting proficiency in PowerShell; comfort with the Graph API
• Ability to write clearly for non-technical audiences, since your work becomes audit evidence
• Experience in a cloud-only environment with no on-premises domain controllers, where devices are Entra-joined rather than hybrid-joined and the user base is fully remote
• Judgment about tooling, not just operation of it. You can tell us when a product we already pay for is the wrong fit and defend the replacement.

Preferred qualifications:

• Healthcare experience with hands-on HIPAA Security Rule application, or prior work supporting HITRUST certification
• Familiarity with MaaS360 specifically
• Experience supporting a remote clinical workforce across multiple time zones
• Jamf, Kandji, or equivalent Apple management platform experience
• Certifications: MD-102, AZ-104, SC-300, or Jamf 200/300

Salary/Rate: $50-$55/HR (depends on experience level). This is a contract position with candidates expected to work 40 hours/ week. 

About Us

Peterson Technology Partners (PTP) is an Equal Opportunity Employer committed to creating a transparent, inclusive, and human-centered hiring experience.

For more than 28 years, PTP has operated as one of the top IT staffing and recruiting firms in the USA—built on trust, long-term partnerships, and technical excellence.

Based in the Chicago suburb of Park Ridge, IL, our team of more than 500 employees and consultants is dedicated to:

• Helping every client make the best hiring decisions possible
• Matching professionals with the right IT jobs and career opportunities

As part of that commitment, we believe in providing clear information about how our hiring technologies work and how your data is used. The following section outlines our AI-assisted interview process and your rights as a candidate.

AI-Assisted Interview Experience (Pete & Gabi – Rebecca):

To provide a consistent, fair, and flexible experience for all candidates, we use AI-assisted tools to support parts of the interview process. This includes our proprietary AI platform Pete & Gabi, which includes AI recruiter Rebecca.

These AI hiring tools help us:

• Conduct recorded video interviews
• Transcribe interviews
• Summarize candidate responses
• Generate job-related insights
• Streamline communication and scheduling

Please note that:

• The AI does NOT make hiring decisions; all decisions are made by our human recruiters, hiring managers, or client partners.
• The AI does not evaluate facial expressions, emotions, or physical traits; it is used only to support fairness, consistency, and efficiency.

If you prefer a non-AI interview format, we will gladly provide an alternative.