Our specific macOS configuration is available on
https://fleetdm.com/handbook/security#how-we-protect-end-use... - but I wanted to take advantage of working at an open-source company to write more about how we ended up doing what we do in terms of security, in a medium that is more appropriate to the story rather than lists of settings.
Hope it is useful, and can help some get started on the path to securing their laptops while leaving them usable by engineers!