Endpoint Security Manager Jobs in Colorado (NOW HIRING)

Primary Job Function:

Systems Administrator responsible for the administration, security, and support of the enterprise endpoint fleet and identity platform in a HIPAA-regulated environment. Responsibilities include Microsoft 365 and Microsoft Intune administration; Entra ID identity and access management; Windows and macOS device management and desktop support; endpoint security and compliance controls protecting Protected Health Information (PHI); administrative automation; and creation and maintenance of documentation including SOPs and runbooks. This is a fully remote position, and all provisioning, administration, and support are performed remotely.

Essential Job Functions:

• Administers Microsoft 365 tenant services, including Exchange Online, SharePoint/OneDrive, and Teams.
• Owns Microsoft Intune administration across Windows and macOS, including device enrollment, configuration and compliance policies, application deployment, patch rings, and update management.
• Performs zero-touch provisioning through Windows Autopilot and Apple Business Manager so that endpoints ship directly to remote employees and are production-ready at first login.
• Maintains standardized, reproducible device builds and reduces configuration drift across the fleet.
• Coordinates endpoint hardware logistics with vendors and depot partners, including procurement, drop-shipping, RMAs, and the secure return or disposal of devices from departing employees.
• Administers Entra ID, including users, groups, roles, licensing, SSO integrations, and application registrations.
• Designs, tests, deploys, and tunes Conditional Access and multi-factor authentication policies.
• Executes identity lifecycle management, including automated onboarding, role changes, and same-day access revocation at offboarding.
• Enforces least-privilege and role-based access across Microsoft 365 and integrated SaaS applications, and conducts periodic access reviews and user access recertification.
• Configures and maintains endpoint controls supporting HIPAA Security Rule safeguards, including access control, automatic logoff, audit logging, and encryption.
• Enforces full-disk encryption on all endpoints (BitLocker and FileVault) and manages key escrow and recovery.
• Maintains data loss prevention and device compliance policies that keep Protected Health Information (PHI) on managed, compliant devices.
• Executes remote lock and wipe for lost, stolen, or compromised devices, and supports incident response and breach investigation with device and access log evidence.
• Applies and maintains endpoint security baselines, and tracks and remediates vulnerability findings across the fleet.
• Maintains documentation and produces evidence for HIPAA audits, risk assessments, SOC 2 reviews, and customer security questionnaires.
• Ensures the rigorous application of Information Security/Information Assurance policies, principles, and practices in the delivery of systems, applications, and services.
• Serves as the escalation point for advanced desktop support across Windows and macOS, including operating system, application, authentication, VPN, network connectivity, printing, and hardware issues, all diagnosed remotely.
• Manages the support ticket queue against defined service level agreements and communicates clearly with non-technical staff, primarily in writing.
• Develops and maintains standard operating procedures, runbooks, internal documentation, and end-user knowledge base articles.
• Reads and writes PowerShell scripts to automate repetitive administrative work. Python is nice to have but not required.
• Tracks hardware, software, and license inventory across the full asset lifecycle.
• Interfaces with internal and external Network Engineers, Security, and Application teams to optimize systems use and configuration.
• Provides technical knowledge and recommendations to staff members as required.
• Some after-hours work will be required for maintenance, patching, and incident response.
• Performs other related duties as assigned.
• Ensures the rigorous application of Information Security/Information Assurance policies, principles, and practices in the delivery of systems, applications, and services.
• Serves as the escalation point for advanced desktop support across Windows and macOS, including operating system, application, authentication, VPN, network connectivity, printing, and hardware issues, all diagnosed remotely.
• Manages the support ticket queue against defined service level agreements and communicates clearly with non-technical staff, primarily in writing.
• Develops and maintains standard operating procedures, runbooks, internal documentation, and end-user knowledge base articles.
• Reads and writes PowerShell scripts to automate repetitive administrative work. Python is nice to have but not required.
• Tracks hardware, software, and license inventory across the full asset lifecycle.
• Interfaces with internal and external Network Engineers, Security, and Application teams to optimize systems use and configuration.
• Provides technical knowledge and recommendations to staff members as required.
• Some after-hours work will be required for maintenance, patching, and incident response.
• Performs other related duties as assigned.

Experience/Education

• Working understanding of HIPAA and the handling of Protected Health Information (PHI) in an end-user computing environment.

General Experience:

• 3-6 years' experience in IT systems administration, including hands-on administration of Microsoft 365 and Microsoft Intune in a production environment.
• 3 years' experience serving as a direct technical interface to internal and external customers.
• Demonstrated desktop support experience on both Windows and macOS.
• Working knowledge of networking fundamentals, including DNS, DHCP, TCP/IP, VPN, and the remote diagnosis of home network and connectivity issues.
• Ability to read and write PowerShell scripts for administrative automation.
• Excellent written communication and self-directed work habits, with sound judgment about when to escalate.

SPECIALIZED EXPERIENCE:

• Demonstrated experience in a majority of the following:

• Day-to-day administration of both Windows and macOS endpoints, rather than depth in one platform with limited exposure to the other.
• Entra ID or Active Directory administration, including SSO, MFA, and Conditional Access.
• Work in a HIPAA compliant environment, including endpoint controls supporting the HIPAA Security Rule.
• Endpoint encryption and key escrow (BitLocker and FileVault).
• Zero-touch provisioning with Windows Autopilot and Apple Business Manager.
• macOS management at scale with Jamf, Kandji, or a comparable platform.
• SaaS identity governance or SCIM-based user provisioning.
• Endpoint detection and response (EDR), SIEM, or vulnerability management tooling.
• Supporting a fully distributed, remote workforce.
• Supporting HIPAA, HITRUST, or SOC 2 audits.

Licensure and/or Certification Requirements:

Must be a U.S. citizen residing in the continental United States and maintain a suitable home work environment with reliable high-speed internet.

Primarily a stationary role performed at a computer workstation, with extended periods of computer use.

Occasional lifting and handling of computer equipment up to 25 pounds.

Some after-hours availability required for maintenance, patching, and incident response.

Minimal travel required.