Asks for

The ad says“Experience with Configuration Management tools: Ansible, Chef, Puppet”
The ad says“Build API integrations across Okta, Workday, UEM/MDM platforms, and Jira Service Management, with solid auth, error handling, and retry logic.”
The ad says“Modern Provisioning: Deep familiarity with modern, zero-touch deployment frameworks such as Windows Autopilot and Apple Business Manager (ABM).”
The ad says“Architect zero touch provisioning workflows leveraging Autopilot and Apple Device Enrollment.”
The ad says“Architect zero touch provisioning workflows leveraging Autopilot and Apple Device Enrollment.”
The ad says“Write and maintain production-grade Python, PowerShell, and Bash tools for OS configuration, packaging, compliance remediation, and lifecycle tasks.”
The ad says“Experience with Configuration Management tools: Ansible, Chef, Puppet”
The ad says“Manage scripts and configs as code: Git, code review, CI/CD, and logging/alerting.”
The ad says“Manage scripts and configs as code: Git, code review, CI/CD, and logging/alerting.”
The ad says“Act as the ultimate technical escalation point for complex identity, access management (IAM), and automated provisioning failures.”
The ad says“Own and optimize modern Unified Endpoint Management (UEM) and MDM platforms (e.g., Jamf, Intune, Kandji) for zero-touch provisioning, automated patching, and security compliance enforcement.”
The ad says“Own and optimize modern Unified Endpoint Management (UEM) and MDM platforms (e.g., Jamf, Intune, Kandji) for zero-touch provisioning, automated patching, and security compliance enforcement.”
The ad says“Build intake forms and workflows (Jira Service Management or Okta Workflows) for new-hire technical profiles.”
The ad says“API integration expertise: strong experience consuming and building against REST APIs (Okta, Workday, Jamf, Intune Graph API, Jira, etc.), including OAuth/token-based authentication, JSON/XML handling, and webhooks.”
The ad says“Own and optimize modern Unified Endpoint Management (UEM) and MDM platforms (e.g., Jamf, Intune, Kandji) for zero-touch provisioning, automated patching, and security compliance enforcement.”
The ad says“Design, build, and maintain enterprise-grade "Gold OS Images" and deployment configurations for macOS, Windows 10/11, and Ubuntu Linux.”
The ad says“Own and optimize modern Unified Endpoint Management (UEM) and MDM platforms (e.g., Jamf, Intune, Kandji) for zero-touch provisioning, automated patching, and security compliance enforcement.”
The ad says“API integration expertise: strong experience consuming and building against REST APIs (Okta, Workday, Jamf, Intune Graph API, Jira, etc.), including OAuth/token-based authentication, JSON/XML handling, and webhooks.”
The ad says“Architect and manage the end-to-end automated lifecycle pipeline using Workday and Okta Lifecycle Management.”
The ad says“Write and maintain production-grade Python, PowerShell, and Bash tools for OS configuration, packaging, compliance remediation, and lifecycle tasks.”
The ad says“Experience with Configuration Management tools: Ansible, Chef, Puppet”
The ad says“Write and maintain production-grade Python, PowerShell, and Bash tools for OS configuration, packaging, compliance remediation, and lifecycle tasks.”
The ad says“API integration expertise: strong experience consuming and building against REST APIs (Okta, Workday, Jamf, Intune Graph API, Jira, etc.), including OAuth/token-based authentication, JSON/XML handling, and webhooks.”
The ad says“Design, build, and maintain enterprise-grade "Gold OS Images" and deployment configurations for macOS, Windows 10/11, and Ubuntu Linux.”
The ad says“Own and optimize modern Unified Endpoint Management (UEM) and MDM platforms (e.g., Jamf, Intune, Kandji) for zero-touch provisioning, automated patching, and security compliance enforcement.”
The ad says“Design, build, and maintain enterprise-grade "Gold OS Images" and deployment configurations for macOS, Windows 10/11, and Ubuntu Linux.”
The ad says“Architect and manage the end-to-end automated lifecycle pipeline using Workday and Okta Lifecycle Management.”
The ad says“API integration expertise: strong experience consuming and building against REST APIs (Okta, Workday, Jamf, Intune Graph API, Jira, etc.), including OAuth/token-based authentication, JSON/XML handling, and webhooks.”

About IonQ:

IonQ, Inc. [NYSE: IONQ] is the world’s leading quantum platform and merchant supplier - delivering integrated quantum solutions across computing, networking, sensing, and security. IonQ’s newest generation of quantum computers, the IonQ Tempo, is the latest in a line of cutting-edge systems that have been helping customers and partners including Amazon Web Services, and AstraZeneca achieve 20x performance results and accelerate innovation in drug discovery, materials science, financial modeling, logistics, cybersecurity, and defense. In 2025, the company achieved 99.99% two-qubit gate fidelity, setting a world record in quantum computing performance.

Headquartered in College Park, Maryland, IonQ has operations in California, Colorado, Massachusetts, Tennessee, Washington, Italy, South Korea, Sweden, Switzerland, Canada, and the United Kingdom. Our quantum computing services are available through all major cloud providers, while we also meet the needs of networking and sensing customers across land, sea, air, and space. IonQ is making quantum platforms more accessible and impactful than ever before.

Location: Bothell, WA
Travel: 10% domestic or international
Job ID: 1714

The Role:

We are seeking a Staff Client Systems Engineer to own, integrate, and optimize our employee lifecycle automation with Okta, and the global endpoint ecosystem. You will be the principal designer of our core operating system configurations and "Gold Images" across a diverse enterprise environment (Mac, Windows, and Ubuntu Linux).

You will serve as the strategic technical bridge between IT and HR. You will architect, implement, and troubleshoot advanced onboarding, offboarding, and transfer workflows—specifically engineering the automated enterprise identity pipeline between Workday and Okta. You will also leverage modern configuration management frameworks to automate endpoint deployment and policy compliance across all operating systems. This role is critical to scaling our global infrastructure, eliminating manual IT overhead, and ensuring a secure, flawless day-one experience for our workforce.

Responsibilities:

Automation & Scripting

Write and maintain production-grade Python, PowerShell, and Bash tools for OS configuration, packaging, compliance remediation, and lifecycle tasks.
Build API integrations across Okta, Workday, UEM/MDM platforms, and Jira Service Management, with solid auth, error handling, and retry logic.
Manage scripts and configs as code: Git, code review, CI/CD, and logging/alerting.

Enterprise Endpoint Architecture & Imaging

Design, build, and maintain enterprise-grade "Gold OS Images" and deployment configurations for macOS, Windows 10/11, and Ubuntu Linux.
Architect zero touch provisioning workflows leveraging Autopilot and Apple Device Enrollment.
Partner closely with the IT Provisioning Team to optimize hardware staging workflows, ensuring images deploy flawlessly and efficiently to end-user machines.
Own and optimize modern Unified Endpoint Management (UEM) and MDM platforms (e.g., Jamf, Intune, Kandji) for zero-touch provisioning, automated patching, and security compliance enforcement.

HR & IT Lifecycle Automation (Workday ⇄ Okta)

Architect and manage the end-to-end automated lifecycle pipeline using Workday and Okta Lifecycle Management.
Build intake forms and workflows (Jira Service Management or Okta Workflows) for new-hire technical profiles.
Ensure instant downstream provisioning and precise access revocation.

Tier-3 Escalation & Mentorship

Act as the ultimate technical escalation point for complex identity, access management (IAM), and automated provisioning failures.
Proactively troubleshoot and resolve deep architectural mismatches between Workday data attributes and Okta downstream applications.
Maintain runbooks and mentor helpdesk, junior admins, and contractors

Requirements:

Experience: 6+ years of experience in Client Systems Engineering, Endpoint Architecture, or IT Infrastructure Automation.
Advanced scripting proficiency: demonstrated, hands-on experience writing production-quality code in Python, PowerShell, and Bash. You should be able to point to tools, integrations, or automation frameworks you have built and maintained, not just one-off scripts
Experience with Configuration Management tools: Ansible, Chef, Puppet
Automation & Form Building: Hands-on experience building dynamic service catalogs, custom forms, and conditional routing workflows for business stakeholders.
API integration expertise: strong experience consuming and building against REST APIs (Okta, Workday, Jamf, Intune Graph API, Jira, etc.), including OAuth/token-based authentication, JSON/XML handling, and webhooks.
Workday & Okta Integration: Proven track record of configuring and maintaining Workday-driven identity provisioning within Okta. Must understand Workday attribute mapping, lifecycle states, and troubleshooting Okta expression language/workflows.
Multi-OS Mastery: Expert-level knowledge of configuring, securing, and imaging Windows, macOS, and Ubuntu Linux at enterprise scale.
Modern Provisioning: Deep familiarity with modern, zero-touch deployment frameworks such as Windows Autopilot and Apple Business Manager (ABM).
Experience in engaging with multiple hardware vendors and VARs

Preferred Qualifications:

Advanced certifications: Okta Certified Consultant/Developer, Jamf Certified Admin, or Workday Extend/Integration certification.
Experience with API integration tools (Postman, Workato, or Okta Workflows).

The approximate base salary range for this position is $126,887- $166,127. The total compensation package includes base, bonus, equity, and a range of benefit options found on our career site.

Compensation will vary based on individual factors such as education, qualifications, and experience of the final candidate(s), specific office location, and calibration against relevant market data and internal team equity. Posted base salary figures are subject to change as new market data becomes available. Our benefits include comprehensive medical, dental, and vision plans, matching 401(k), unlimited PTO and paid holidays, parental/adoption leave, legal insurance, and a home technology stipend. Details of participation in these benefit plans will be provided when a candidate receives an offer of employment.

At IonQ, we believe in fair treatment, access, opportunity, and advancement for all while striving to identify and eliminate barriers. We empower employees to thrive by fostering a culture of autonomy, productivity, and respect. We are dedicated to creating an environment where individuals can feel welcomed, respected, supported, and valued.

We are committed to equity and justice. We welcome different voices and viewpoints and do not discriminate on the basis of race, religion, ancestry, physical and/or mental disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, transgender status, age, sexual orientation, military or veteran status, or any other basis protected by law. We are proud to be an Equal Employment Opportunity employer.

US Technical Jobs. The position you are applying for will require access to technology that is subject to U.S. export control and government contract restrictions. Employment with IonQ is contingent on either verifying “U.S. Person” (e.g., U.S. citizen, U.S. national, U.S. permanent resident, or lawfully admitted into the U.S. as a refugee or granted asylum) status for export controls and government contracts work, obtaining any necessary license, and/or confirming the availability of a license exception under U.S. export controls. Please note that in the absence of confirming you are a U.S. Person for export control and government contracts work purposes, IonQ may choose not to apply for a license or decline to use a license exception (if available) for you to access export-controlled technology that may require authorization, and similarly, you may not qualify for government contracts work that requires U.S. Persons, and IonQ may decline to proceed with your application on those bases alone. Accordingly, we will have some additional questions regarding your immigration status that will be used for export control and compliance purposes, and the answers will be reviewed by compliance personnel to ensure compliance with federal law.

US Non-Technical Jobs. Due to applicable export control laws and regulations, candidates must be a U.S. citizen or national, U.S. permanent resident (i.e., current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum. Accordingly, we will have some additional questions regarding your immigration status that will be used for export control and compliance purposes, and the answers will be reviewed by compliance personnel to ensure compliance with federal law.

If you are interested in being a part of our team and mission, we encourage you to apply!