高级安全工程师，终端设备
Senior Security Engineer, Endpoint
RAMP简介
Ramp正在构建财务团队的智能基础设施，嵌入企业每一美元支出的交易流程中。我们自动化处理超过2000亿美元的年度支出在70,000多家公司中的流动：授权支付、标记风险、分类支出、完成账务结算。
这些问题具有高风险、数据密集且不容错误。
我们招聘具有高度自主性和紧迫感的人才。我们更看重的是你所构建的东西，而不是你在哪里学习的。在Ramp，每个人都是从头到尾负责问题的建造者，并做出影响结果的重要决策。
Ramp的平均客户在第一年节省了5%的成本，并实现了16%的收入增长——远超没有使用Ramp的企业。我们相信每家有抱负的公司都应享有同样的优势。
如果你希望构建直接塑造公司如何移动和管理数十亿美元的系统，Ramp就是你的选择。
职位简介
你将负责我们整个设备阵容（macOS、Windows和自带设备的移动设备）的端点安全态势。你将使用Terraform和GitOps构建默认安全的控制措施，大规模加固端点，自动化完整的设备生命周期，确保没有任何东西依赖于人类记得点击正确的按钮。你将与IT、SecOps和工程团队合作，提升我们的遥测和检测能力，指导其他工程师，并重新定义“低摩擦安全”的实际含义。你所交付的每项工作都将可审计、可衡量，并为长期发展而构建。
我们也在认真思考在代理世界中企业安全如何演变——在这样的世界中，AI代理代表员工行动，传统的身份和端点假设开始失效。你将帮助我们制定这一问题的答案。
你将负责的工作
- 以代码形式编写并交付MDM策略——在macOS、Windows和移动设备上配置文件、修复脚本和执行规则，从第一天起就支持分阶段推出和回滚
- 构建补丁自动化系统，快速关闭暴露窗口，同时不让员工的生活变得更糟
- 管理整个设备群的软件分发
- 分析设备群的遥测数据以获取信号——构建仪表板、漂移警报和AI辅助自动化，防止工作量积累
- 负责受管理浏览器和扩展策略：强制执行允许的内容，阻止不允许的内容，并随着范围扩大保持控制平面的可审计性
- 在IT运维无法解决的端点升级问题中成为最后一道防线
查看英文原文
ABOUT RAMP
Ramp is building the smart infrastructure for finance teams, embedded in the transaction flow of every dollar a business spends. We automate how over $200B in annualized spend flows in and out of 70,000+ companies: authorizing payments, flagging risk, categorizing spend, and closing books.
The problems are high-stakes, data-dense, and unforgiving.
We hire people with high agency and high urgency. We look for slope over intercept. We care less about where you trained and more about what you’ve built. At Ramp, everyone is a builder who owns problems end to end and makes consequential decisions that shape the outcome.
The median Ramp customer saves 5% and grows revenue 16% in their first year – far in excess of businesses operating without Ramp. We believe every ambitious company deserves the same.
If you want to build systems that directly shape how companies move and manage billions, Ramp is the place to do it.
ABOUT THE ROLE
You'll be the architect of our endpoint security posture across the full fleet — macOS, Windows, and BYOD mobile devices. You'll build secure-by-default controls with Terraform and GitOps, harden endpoints at scale, and automate the full device lifecycle so nothing depends on a human remembering to click the right button. You'll partner with IT, SecOps, and engineering teams to sharpen our telemetry and detections, mentor other engineers, and raise the bar on what "low-friction security" actually means. Everything you ship will be auditable, measurable, and built for the long run.
We're also thinking seriously about how corporate security evolves in an agentic world — where AI agents act on behalf of employees and traditional identity and endpoint assumptions break down. You'll help us shape that answer.
WHAT YOU’LL DO
- Write and ship MDM policy as code — configuration profiles, remediation scripts, and enforcement rules across macOS, Windows, and mobile — with staged rollouts and rollback from day one
- Build patch automation that closes exposure windows fast without making employees' lives worse
- Manage software distribution across the fleet
- Mine fleet telemetry for signal — build dashboards, drift alerts, and AI-assisted automation that cuts toil before it compounds
- Own managed browser and extension policy: enforce what's allowed, block what isn't, and keep the control plane auditable as the surface grows
- Be the last line of defense on endpoint escalations that IT Operations can't crack
WHAT YOU NEED
- Deep macOS security experience — Jamf Pro, FleetDM, or equivalent MDM at scale
- Strong IaC fundamentals and a GitOps delivery model — Terraform modules, remote state, and CI pipelines shipped through MRs and code review, not tickets and manual steps
- Solid working knowledge of Google Workspace in a managed enterprise environment, including Chrome Browser Cloud Management and extension policy enforcement
- A point of view on how agentic AI changes the corporate security surface
NICE-TO-HAVES
- Have shipped real work with open source endpoint and device management tooling
- Have built automated, progressive rollout systems based on fleet telemetry.
- Have managed a mixed fleet — macOS, Windows, and mobile — with real depth on at least one platform
- Have put AI to work on real operational problems, not just prototyped
BENEFITS AVAILABLE TO ALL FULL-TIME RAMP EMPLOYEES (GLOBAL)
- Flexible PTO
- Centralized home-office equipment ordering
- Health and wellness stipend
- Budget for intra-office travel
- Weekly coffee stipend
UNITED STATES
- 100% medical, dental & vision insurance coverage for you, with partial coverage for dependents
- One Medical annual membership
- 401(k), including employer match on contributions made while employed by Ramp
- Fertility HRA (up to $10,000 per year)
- Parental leave: up to 16 weeks (birthing + bonding) or 8 weeks (bonding only) at 100% pay
- Pet insurance
- In-office perks: lunch, snacks, drinks, and more
- Relocation expense coverage to NYC or SF (if needed)
CANADA
- Group medical, dental, and vision coverage through Sun Life
- Life, AD&D, and disability coverage
- Fertility drug coverage (up to $4,000 lifetime)
- Group Retirement Plan with employer match (RRSP + DPSP)
- Parental leave: up to 16 weeks (birthing + bonding) or 8 weeks (bonding only) at 100% pay, with additional time available at reduced pay
- Employee Assistance Program and virtual care through Lumino Health
UNITED KINGDOM
- Private medical insurance through Freedom Elite
- Virtual GP and at-home care via eMed x Livi
- Workplace pension through Penfold, with salary sacrifice option
- Parental leave: up to 16 weeks (birthing + bonding) or 8 weeks (bonding only) at 100% pay with additional time available at reduced pay
REFERRAL INSTRUCTIONS
If you are being referred for the role, please contact that person to apply on your behalf.
OTHER NOTICES
Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
Beware of recruiting scams: Ramp will only contact you through official @Ramp.com http://Ramp.com email addresses and will never ask for payment or sensitive personal information during the hiring process.
Ramp Applicant Privacy Notice https://ramp.com/legal/applicant-privacy-notice