IT Systems Engineer

The role

Kikoff is hiring its first dedicated Systems Engineer. This isn't an IT support role — you'll be standing up AI-powered internal tooling (MCP, agents), owning our corporate identity foundation, and improving our overall corporate security. You'll work directly with the engineering and security teams.

What you'll own

Corporate IT infrastructure — own and evolve our SaaS stack (Okta, Google Workspace, Slack). Procurement, provisioning, and lifecycle management

Identity & device trust — operate and mature our MDM stack (Rippling/Jamf/Kandji), enforce Okta Device Trust policies, and ensure endpoints meet our security baseline

MCP servers & AI agents — build and maintain internal MCP servers; design agents that automate internal ops and extend what the security and engineering teams can do

Endpoint hardening & macOS/Windows fleet management — configuration profiles, CIS benchmark enforcement, macOS scripting, software deployment, and patch management

Security automation — turn manual security tasks into automated workflows: access reviews, alert triage, onboarding/offboarding, posture checks

What we're looking for

Must-have

4+ years in systems engineering, corporate IT, or a hybrid IT/security role — ideally at a startup

Deep macOS fluency: shell/Python scripting, configuration profiles, and hands-on MDM troubleshooting

Hands-on MDM experience (i.e., Rippling, Jamf, Kandji) — enrollment, policies, smart groups, zero-touch provisioning

Okta administration: lifecycle management, device trust policies, group rules

Proficient in scripting and building software — bash and Python at minimum. Expected to own automation scripts and internal tooling.

SaaS stack management: tool inventory, vendor renewals, access governance

Proficient using AI tools (Claude, Cursor, Codex or similar) as part of your daily workflow

Strong plus

Experience building or operating MCP servers or LLM agents

Familiarity with security concepts: least privilege, zero trust endpoint posture, log forwarding, DLP basics

Exposure to AWS IAM or cloud infrastructure

Experience with device trust architectures (Okta Device Trust, CrowdStrike, or similar)

Built internal tooling from scratch — provisioning workflows, self-service automations, or agent-driven ops

Base Range

$190,000—$240,000 USD