Stephen Laney · Senior Client Platform Engineer
Nine years as the sole MDM and platform owner for mixed macOS and Windows fleets of up to 1,700 endpoints, currently around 1,200 at Airtable. I work where device management meets identity, PKI, and AI agent governance, and most of what is on this page exists because I did not want to do the same task by hand twice.
Currently on my plate updated Aug 2026
A local binary that assesses and reports device compliance on its own, closing the 24-hour reporting gap most zero trust models inherit when MDM is the source of truth.
Working through four years and three MDM engineers worth of accumulated packages, scripts, policies, and configuration profiles, retiring everything obsolete or inactive.
One place for live and historical security compliance data across the Jamf and Intune fleets, fed directly by our security systems.
Replacing the DNS filtering service on our endpoints with a Zero Trust network access layer.
01 · Selected work
The projects below are the ones I point to when someone asks what a client platform engineer actually does. Each one went from design through rollout on a live fleet.
Revamped zero-touch Mac provisioning onto a modern Okta Platform SSO workflow, authenticating users against Okta during ADE Setup Assistant before the first local account is created. I led the rollout end to end, including licensing, third-party risk and SOC 2 Type II review, SCEP configuration, and Okta Verify packaging.
Okta-issued SCEP certificates had no auto-renewal, which meant a manual org-wide renewal every year. I partnered with systems engineering to deploy an AppViewX PKIaaS hierarchy with Jamf Pro as SCEP proxy using dynamic challenge webhooks, plus parallel Intune SCEP for the Windows side.
Designed the enforced Claude Code managed-settings configuration and its script-based MDM delivery, with a Jamf Extension Attribute validating config integrity and gating redeployment. Extended the same pattern to OpenAI Codex via base64-encoded TOML, delivered org-wide within hours of security sign-off.
Audited every extension attribute script for purpose, logic, and runtime, and removed a redundant filesystem scan once it proved to serve no active requirement. Fleet-wide inventory collection dropped from up to five minutes to 15 to 20 seconds, alongside repairing four years of inherited broken policies and app deployment configurations.
Led the org-wide implementation of AppAutoPatch, automating updates for 151 application titles. Vulnerable application and CVE findings dropped 89 percent, from 9,541 to 1,049.
Moved every policy and extension attribute script under source control, with a CI/CD change pipeline where changes enter as pull requests and require review before reaching Jamf. No more direct console edits: all code executing on managed endpoints carries a peer-reviewed, auditable change history.
Led migration of Windows, iOS, and Android management off VMware Workspace ONE to Microsoft Intune, having first stood up the fleet's original managed Windows baseline on Workspace ONE from the ground up.
Designed and led the pandemic remote-work migration, building the process that put securely configured laptops and matched peripherals into the hands of more than 600 employees. Scoped, coordinated, and executed in under a week.
02 · Experience
Three organizations, one pattern: inherit or stand up an endpoint platform, make it auditable, then automate it.
03 · Agents
These run against my production fleet every day. The rule set is the same across all of them: reads are open, writes are approval gated, and every action lands in an audit log I can hand to anyone who asks.
Runs twice a day against a support dashboard of roughly 66,000 records, pulls the tickets where I am the DRI, groups them by urgency, and attaches a proposed next action to each one. It tracks the delta between runs instead of re-sending the same list, so a quiet queue produces a quiet digest.
Sweeps about 15 IT channels, classifies the traffic against my role, and only sends a DM when something clears an urgency bar it raises automatically when I am out of office. It distinguishes bot traffic from human senders, tracks standing tickets and live incidents, and stays silent when a sweep finds nothing worth my time.
A read-only auditor for inventory, configuration profiles, policies, and check-in health, paired with an approval-gated operator that handles patching, MDM commands, and group or policy edits with dry-run previews before anything executes. This pair produced my macOS compatibility audits, a 631-device stale-record reliability report, and the quarterly fleet metrics dashboard.
The auditor runs a weekly read-only posture review of 65 weighted checks across 15 categories and emits an HTML dashboard plus trend data. The manager executes 43 approval-gated Microsoft Graph operations covering devices, profiles, compliance, apps, and Autopilot. It replaced manual console compliance review entirely.
Fully unattended. When a laptop is marked for donation in our asset base, a webhook fires, the device is unassigned from its MDM server in Apple Business Manager by serial number, and the record is stamped with the result. Authenticates to Apple with OAuth and ES256-signed JWTs. No human in the loop.
Built out of a 404-device fleet outlier investigation. It works each device through Jamf and our asset data, writes findings to a dedicated investigations base, and grades every finding by whether an agent can remediate it or a human needs to. It sorts its own backlog, then a published dashboard fronts the results.
04 · Code
Most of my fleet code lives in internal repos behind the change pipeline above. These are the public pieces.
Production scripts from managing Macs with Jamf: a power-assertion-aware policy delayer that holds updates while someone is on a video call, a self-service log collection tool that uploads sysdiagnose and app logs to S3 and notifies IT in Slack, and an MDM failed-command report that walks a smart group through the Jamf API. Secrets are handled with encrypted-string decryption rather than plaintext parameters.
View on GitHub →A personal project: a Flask and SQLite app that gives my kids a parent-curated YouTube library on our home network. Videos are added by script through the YouTube Data API, browsed by category and channel, and served on restricted machines that can only reach whitelisted sites. Same instinct as the day job, just aimed at a smaller fleet.
View on GitHub →05 · Stack
Bolded where I have owned the platform, not just used it.
06 · Contact
If you are working on fleet management, PKI, or figuring out how to let agents do real IT work without losing the audit trail, I am happy to compare notes.
Away from the keyboard I am rock climbing, mountain biking, 3D printing, building something in the garage, or hanging out with my wife and kids. Idaho Falls, Idaho.