Senior Modern Workplace Engineer

What This Role Is Expected to Deliver

Build a secure, scalable and low-touch endpoint platform for Windows devices, with increasing capability across macOS.
Reduce manual administration through PowerShell, Microsoft Graph and proactive remediation/automation.
Improve device compliance, deployment quality, patch posture and endpoint security without creating unnecessary friction for users.
Own endpoint-related projects from design and pilot through production rollout, documentation, change communication and operational handover.
EPM, SAAS Management, Shadow IT/AI and AI Governance are key projects in Pipeline.

Key Responsibilities

Design, deploy and administer Microsoft Intune for device compliance, configuration profiles, security baselines, enrollment, application deployment and update management.
Own Windows Autopilot end to end, including device registration, hardware hashes, deployment profiles, Enrollment Status Page (ESP), user-driven and pre-provisioned scenarios, troubleshooting and lifecycle operations.
Design and maintain Conditional Access controls tied to compliant/corporate devices, MFA and Zero Trust access principles in partnership with security and identity stakeholders.
Manage the endpoint-related Microsoft Entra ID surface, including device identity, registration, join states, authentication dependencies and access troubleshooting.
Package, test and deploy Win32, Microsoft Store and line-of-business applications, including detection rules, dependencies, install/uninstall logic and remediation of failed deployments.
Build PowerShell and Microsoft Graph automation for reporting, compliance, device operations, configuration validation and repetitive administration.
Create and maintain proactive remediation/detection-remediation logic to address configuration drift, device health and recurring endpoint issues before they become tickets.
Own Windows patch/update strategy using Windows Update for Business, update rings and related Microsoft capabilities; support application patching and verification processes.
Implement and improve endpoint security controls including BitLocker, LAPS, attack-surface reduction/security baselines and integration with enterprise security tooling such as CrowdStrike or Microsoft Defender concepts.
Support and progressively deepen macOS management capability using Jamf Pro/Apple Business Manager, ADE, FileVault and macOS compliance where applicable.
Act as the L3 escalation point for complex enrollment failures, policy conflicts, Autopilot provisioning issues, application deployment failures and device compliance problems.
Work across Microsoft 365 services such as OneDrive, SharePoint, Teams and Exchange Online where endpoint or identity policies intersect with the user experience.
Evaluate new Microsoft/Apple endpoint capabilities, and recommend production adoption when they improve security, supportability or user experience.
Create technical documentation, SOPs and runbooks; mentor other IT team members and transfer knowledge rather than becoming a single point of dependency.

Required Skills - Must Have

Strong hands-on Microsoft Intune administration in an enterprise environment.
Strong Windows Autopilot implementation and troubleshooting experience.
Strong understanding of compliance policies, configuration profiles, security baselines and device lifecycle management.
Hands-on application packaging/deployment using Win32 (.intunewin) or equivalent enterprise packaging methods, including detection and dependency logic.
Hands-on Microsoft Entra ID and Conditional Access experience, especially device-based access and compliance scenarios.
Strong L3 troubleshooting ability across enrollment, policy, application deployment, authentication and compliance issues.
Strong PowerShell scripting skills for automation and troubleshooting.
Practical endpoint security knowledge including disk encryption, endpoint hardening, patching and least-privilege concepts.
Ability to independently plan and execute technical changes/projects with pilots, rollback thinking, stakeholder communication and post-change validation.
PIM, SSO concepts (SAML/OIDC), enterprise application registration and broader Entra identity administration.
Jamf Pro, Apple Business Manager/ADE, FileVault and macOS administration.

Adjacent Skills - Good to Have / Learn Quickly

Microsoft Graph API automation and reporting.
BeyondTrust Endpoint Privilege Management (EPM), Microsoft EPM or similar least-privilege tooling.
CrowdStrike, Microsoft Defender for Endpoint or comparable endpoint security platforms.
Microsoft 365 migration or tenant-to-tenant migration experience.
ISO 27001, SOC 2, GDPR or similar control/compliance environments.

What Success Looks Like

Takes independent ownership of the Intune/Autopilot/Entra endpoint stack and becomes the escalation point for complex endpoint problems.
Automates recurring endpoint work and reduces avoidable manual administration/tickets.
Improves compliance, patching and endpoint security posture while keeping user experience practical.
Builds working knowledge in adjacent areas such as Jamf/macOS, EPM and broader identity rather than remaining an Intune-only specialist.
Demonstrates learnability: can identify a knowledge gap, self-learn, test in a lab/pilot, apply the capability in production, document it and transfer the knowledge to others.

Experience & Qualifications

8+ years relevant experience across enterprise IT, Microsoft 365, endpoint/security or related infrastructure disciplines.
Demonstrated experience owning production systems and resolving complex technical problems, not only following predefined operational procedures.
Experience working with distributed/global stakeholders and managing technical changes across business teams is preferred.
Bachelor's degree or equivalent practical experience in Information Technology, Computer Science or a related discipline.

Preferred Certifications

Microsoft Certified: Endpoint Administrator Associate (MD-102)
Microsoft 365 Administrator / MS-102 or equivalent Microsoft 365 administration certification
Microsoft Identity and Access Administrator (SC-300) - preferred
Jamf certification - advantage, not mandatory