Senior Windows Engineer, Endpoint Engineering

Job description

Job Description

The Senior Windows/SCCM/Intune Engineer is responsible for the architecture, engineering, automation, security, and lifecycle management of the firm's global Windows endpoint environment. This role serves as a senior technical leader within End User Engineering, driving enterprise device management strategies across Microsoft Configuration Manager (SCCM/MECM), Microsoft Intune, Microsoft Entra ID, and Windows 11 platforms.

The engineer will design and maintain modern endpoint management solutions, software deployment frameworks, operating system lifecycle processes, compliance enforcement, and endpoint security configurations. This individual will collaborate closely with Information Security, Infrastructure, Service Desk, Unified Communications, and Application teams to deliver a secure, scalable, and highly automated digital workplace experience for employees worldwide.

Reporting relationshipsReports to: Senior Manager, Digital Workplace

Primary functions & responsibilities1. Endpoint Engineering & Management

Design, implement, and support enterprise Windows endpoint management solutions.Manage and optimize Microsoft Configuration Manager (SCCM/MECM) infrastructure.Lead migration initiatives from traditional SCCM management toward cloud-native management using Microsoft Intune.Engineer and maintain Microsoft Intune policies for device compliance, configuration, security baselines, endpoint protection, and application deployment.Develop and maintain device provisioning strategies utilizing:Windows AutopilotMicrosoft IntuneHybrid Azure AD JoinEntra ID JoinEstablish endpoint configuration standards across global environments.Drive hardware refresh and operating system modernization initiatives.Maintain endpoint inventory, reporting, and lifecycle management processes.

2. Operating System Engineering

Lead Windows 11 deployment, maintenance, and upgrade programs.Develop and maintain enterprise OS deployment task sequences and Autopilot provisioning packages.Engineer standardized endpoint configuration profiles and provisioning methodologies.Manage feature updates, quality updates, and servicing channels.Perform application compatibility testing and remediation.Develop rollback and contingency plans for large-scale deployment initiatives.

3. Application Packaging & Deployment

Package, test, deploy, and maintain enterprise software solutions.Develop deployment methodologies utilizing:Intune Win32 ApplicationsSCCM ApplicationsPowerShellWingetTroubleshoot complex installation and application-related issues.Create detection methods, superseding strategies, and deployment automation workflows.Manage application lifecycle processes from onboarding through retirement.

4. Automation & Scripting

Develop automation solutions using:PowerShellPowerShell App Deployment Toolkit (PSADT)Graph APIAzure AutomationAzure FunctionsAutomate administrative tasks and operational processes.Create self-healing and proactive remediation scripts.Develop reporting, monitoring, and compliance automation solutions.Reduce operational overhead through infrastructure-as-code methodologies.

5. Endpoint Security & Compliance

Partner with Information Security teams to implement endpoint security controls.Engineer and maintain:Intune Patch Management / AutopatchSCCM/WSUS software updatesAttack Surface Reduction RulesDevice Control PoliciesBitLocker EncryptionSecurity BaselinesGroup Policy ManagementConditional Access integrationsEnsure compliance with regulatory and corporate security requirements.Evaluate vulnerabilities and coordinate remediation activities.Support audit readiness and security reviews.

6. Microsoft Cloud Technologies

Support and integrate:Microsoft IntuneMicrosoft Entra IDMicrosoft DefenderMicrosoft 365 AppsWindows Update for BusinessMicrosoft GraphDevelop modern management strategies aligned with Microsoft's cloud-first approach.Manage co-management capabilities between SCCM and Intune.Optimize device management through cloud-based services and automation.

7. Digital Employee Experience (DEX)

Utilize Digital Experience Monitoring tools such as:NexthinkMicrosoft Endpoint AnalyticsLakeside SysTrackControlUpAnalyze endpoint health and performance trends.Develop initiatives to improve:Device performanceBoot timesReliabilityApplication experienceEmployee productivityCreate executive-level reporting and operational dashboards.

8. Documentation & Operational Excellence

Create and maintain:Technical documentationStandard operating proceduresEngineering standardsRunbooksKnowledge articlesDevelop operational dashboards and reporting metrics.Maintain architecture diagrams and platform documentation.Drive continuous process improvement initiatives.Serve as Tier 3/Level 4 escalation support for complex endpoint issues.Perform root cause analysis for recurring incidents and service disruptions.Participate in maintenance windows and critical incident response activities.Establish monitoring and alerting strategies for endpoint services.Maintain service reliability and performance targets.

QualificationsEducation:

Bachelor’s degree in Computer Science, Information Systems, Engineering, or related technical field.

Advanced degree strongly preferred.

Experience Required:

Required

7+ years of enterprise endpoint engineering experience.5+ years managing Microsoft Configuration Manager (SCCM/MECM).3+ years managing Microsoft Intune in a large enterprise environment.Experience supporting environments with 5,000+ endpoints preferred.Experience in financial services, healthcare, legal, or highly regulated industries preferred.

Preferred Certifications

Microsoft Certified: Endpoint Administrator AssociateMicrosoft Certified: Azure Administrator AssociateMicrosoft Certified: Enterprise Administrator ExpertMicrosoft Certified: Security Operations Analyst AssociateITIL FoundationsMCM, MCSE, or equivalent legacy Microsoft certifications

Technical Skills

Expert KnowledgeWindows 11 administrationMicrosoft Configuration Manager (SCCM/MECM)Microsoft IntuneWindows AutopilotPowerShell scriptingMicrosoft Entra IDGroup Policy ManagementEndpoint security technologiesSoftware packaging and deployment

Advanced KnowledgeCo-ManagementWindows Update for BusinessMicrosoft Defender for EndpointBitLockerConditional AccessAzure AutomationMicrosoft Graph APIActive DirectoryDNS/DHCP fundamentalsPKI/Certificate Services

Preferred SkillsMicrosoft 365Defender XDRNexthinkServiceNowAzure Virtual DesktopWindows 365Azure InfrastructureEnterprise mobility managementZero Trust architecturesGeneral Requirements:

Strong written and verbal communication skillsAbility to manage multiple projects and priorities simultaneouslyExperience working in global enterprise environments, preferably in financial services or other highly regulated environmentsWillingness to travel (approximately 10-25%)

Reporting Relationships

Senior Manager, Digital Workplace

Compensation

The anticipated rate for this position is listed below. Total compensation may also include a discretionary performance-based bonus.

$125,000 - $140,000

The firm also offers robust Benefits offerings. Ares U.S. Core Benefits include Comprehensive Medical/Rx, Dental and Vision plans; 401(k) program with company match; Flexible Savings Accounts (FSA); Healthcare Savings Accounts (HSA) with company contribution; Basic and Voluntary Life Insurance; Long-Term Disability (LTD) and Short-Term Disability (STD) insurance; Employee Assistance Program (EAP), and Commuter Benefits plan for parking and transit.

Ares offers a number of additional benefits including access to a world-class medical advisory team, a mental health app that includes coaching, therapy and psychiatry, a mindfulness and wellbeing app, financial wellness benefit that includes access to a financial advisor, new parent leave, reproductive and adoption assistance, emergency backup care, matching gift program, education sponsorship program, and much more.

There is no set deadline to apply for this job opportunity. Applications will be accepted on an ongoing basis until the search is no longer active.