Forward Deployed Engineer, StitchOps, Inc.

Location: [Remote, Mexico] · Travel: [0%] · Reports to: CTO & Co-founder, Kyle Harris

About StitchOps

Most enterprise software has no usable API. StitchOps automates the work that lives there: joiner, mover and leaver changes, access provisioning, password resets and admin tasks across SaaS apps, legacy web portals and desktop software. Our worker runs inside the customer’s own environment, so their data and credentials never leave it. We’re a certified Okta delivery partner and listed in the Okta Integration Network.

The role

You get StitchOps live inside a customer’s environment and keep it running. You work between the customer’s identity, infrastructure and security teams on one side and our product team on the other. You deploy workers, connect directories and identity providers, build the first production workflows, and turn what you see in the field into product changes.

This is an engineering role. It is not presales and it is not supported. You’ll write code, read logs, debug TLS chains and fix broken selectors. You’ll also be the person a customer’s IT director trusts with their Active Directory.

What you’ll do

Deploy

- Install and run StitchOps workers on Windows and macOS, in customer AWS and Azure accounts and on premises: silent enterprise installs, service accounts, auto start, updates and fleet health.
- Get workers through locked down networks: proxies, TLS inspection (Zscaler and similar), private certificate authorities, firewall allow lists, and access over SSM or a bastion host.
- Connect identity sources:
- Active Directory over LDAP and LDAPS, including service account scoping, domain controller targeting and replication timing
- Entra ID with Connect Sync or Cloud Sync, password hash sync and pass through authentication
- Okta SCIM and SAML app publishing
- Google Workspace
- Connect customer key vaults (Azure Key Vault, HashiCorp Vault, AWS Secrets Manager, 1Password, Keeper) with least privilege service accounts and credential rotation.

Build





- Write and harden production workflows across browser automation, desktop UI Automation, LDAP, REST APIs and identity operations, using JSON workflow specs and our MCP and AI authoring tools.
- Make automation survive real applications: resilient selectors, MFA and one time codes, bot walls, iframes, session handling, and failures that are safe to retry.
- Build the identity operations for each application (create, read, update, disable, delete, group membership) and map the customer’s SCIM attributes onto them.
- Write the glue code: Python on the worker side, Node.js on the API side, plus scripts, seed data and test harnesses.

Own the outcome

- Run technical discovery and scope each deployment: which apps, which operations, which identity sources, and which security constraints.
- Lead go live, then write the runbooks and handover so the customer’s team can run it without you.
- Answer security reviews and questionnaires on network design, data flow, credential handling and logging.
- Take production issues from customer report to error code to root cause to fix, or to a precise bug for the product team.
- Bring field patterns back to product: new node types, connector gaps, installer and deployment friction.

What you bring

Must have

- 4+ years in a technical, customer facing engineering role: forward deployed, solutions or implementation engineering, or a senior SRE or IT engineer who enjoys working with customers.
- Strong identity knowledge: Active Directory and LDAP, Entra ID and hybrid identity, SAML and OIDC, SCIM, joiner/mover/leaver processes, and clean service account practices.
- Comfort administering Windows (services, Task Scheduler,



PowerShell, certificate stores, Group Policy basics) and enough Linux and macOS to get around.
- Networking and TLS debugging: DNS including SRV records, proxies, certificate chains and inspection, outbound only architectures.
- Fluent Python, plus JavaScript and Node.js or the willingness to learn them quickly.
- Real browser automation experience with Playwright, Puppeteer or Selenium, including flaky selectors, waits, iframes and login flows.
- Sound judgment with sensitive systems. You’ll work in production directories and handle credentials, and you will never log a password, a field value or personal data.
- Clear writing: runbooks, security answers, and plain English emails to an IT director.

Nice to have

- Okta administration (Lifecycle Management, Workflows, OIN), JumpCloud, or IGA tools such as SailPoint or Saviynt.
- MSP experience or a background in regulated industries such as banking, healthcare or automotive dealer groups.
- AWS (EC2, SSM, KMS, IAM), Terraform and CI/CD.
- Desktop automation: Windows UI Automation, Citrix or VDI apps, OCR driven flows.
- LLM tooling: MCP, agent harnesses, prompt driven authoring.
- Security experience: SOC 2 environments, security reviews, least privilege design.

What success looks like

- 30 days: You can deploy a worker into a locked down Windows environment and ship an Active Directory password reset workflow to production on your own.
- 90 days: You’ve led at least one customer from kickoff to go live, including identity provider integration and the security review.
- 6 months: Customers ask for you by name, your field fixes have shipped in the product, and the next FDE is onboarding from runbooks you wrote.

Compensation

[Negotiable]

The main changes: a sharper opening that leads with the no API problem and the “your data stays in your environment” point, tighter bullets, and consistent formatting throughout. The bracketed placeholders are still there for you to fill in.

📌 Forward Deployed Engineer (FDE) (México)
🏢 StitchOps
📍 México