Endpoint Management Engineer

Job description

Duties and Responsibilities

Primary

Serves as the deployment authority for the workstation environment — owns the deployment calendar and coordinates with other engineers across the group to determine scheduling and sequencing for all software, update, and configuration deployments pushed to firm workstations.Creates and manages change control tickets for all workstation deployments in accordance with firm change management policy, ensuring that required documentation, approvals, and risk assessments are completed prior to deployment.Monitors and enforces workstation software compliance for all deployed applications, operating system updates, BIOS/firmware updates, and hardware driver updates across the firm's managed Windows and macOS device fleet.Tracks deployment success rates via SCCM/ConfigMgr, Intune, and Jamf Pro; identifies noncompliant, unreachable, or failing endpoints and drives remediation to closure.Owns the deployment pipeline for BIOS/firmware and driver updates across the Windows device fleet, including packaging, testing, staged rollout, and post-deployment validation (primarily Lenovo hardware).Manages macOS workstation compliance in Jamf Pro, including application deployment, macOS update enforcement, configuration profile compliance, and device inventory accuracy.Prioritizes security-relevant application and OS updates to ensure timely workstation delivery in alignment with firm policy; coordinates with information security when patch timelines or compliance gaps require escalation.Partners with information security as needed to provide deployment compliance data, reporting, and evidence for audits or vulnerability management reviews — serving as the subject-matter expert on workstation software state.Develops and maintains compliance dashboards and reporting for software update health across Windows and macOS endpoints, highlighting trends, persistent failures, and remediation status for IT leadership.Authors and maintains deployment runbooks, compliance procedures, and exception-handling documentation to support consistent operations and knowledge transfer.Identifies systemic causes of deployment failures (e.g., client health issues, network constraints, policy conflicts, Jamf enrollment gaps) and implements durable solutions rather than one-off fixes.Leads projects independently as required — defining scope, coordinating stakeholders, managing timelines, and delivering outcomes with minimal direct oversight.Collaborates with the Applications Engineering team on new application deployments to build compliance monitoring into rollouts from the outset, for both Windows and macOS platforms.Evaluates and recommends tooling improvements or process enhancements that increase deployment reliability and compliance visibility across the full workstation fleet.Provides escalation support for complex deployment or compliance issues affecting end-user productivity.Develops and maintains end-user communications and guidance aimed at improving update compliance — including messaging around device availability during deployment windows — and works collaboratively with end users to identify software gaps and develop practical solutions that increase overall compliance rates.

Secondary

Performs other duties as assigned.

Minimum Qualification

Education

Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent experience in the computer/technical industry.

Experience

5–8 years of experience in endpoint or workstation management, systems administration, or IT operations with a demonstrable focus on patch management, software deployment, and compliance across Windows environments. Experience with macOS management is a plus. Experience in a law firm or professional services environment is preferred.

Special Knowledge

Microsoft Endpoint Configuration Manager (SCCM/ConfigMgr), Windows Server Update Services (WSUS), Microsoft Intune, Active Directory, and Group Policy. Jamf Pro for macOS workstation management, including policy deployment, configuration profiles, and patch enforcement. Familiarity with CyberArk EPM or similar endpoint privilege management tools. Knowledge of BIOS/UEFI firmware update mechanisms and hardware driver management, preferably in a Lenovo environment. Familiarity with Azure services including Entra ID is a plus.

Technical Skills

Proficiency with PowerShell scripting for automation of compliance reporting, remediation tasks, and deployment workflows on Windows. Familiarity with Bash or shell scripting for macOS automation within Jamf is a plus. Solid understanding of Windows operating system internals as they relate to update and patch application on workstations. Experience querying SCCM/Intune data via SQL or built-in reporting to build compliance dashboards. Hands-on experience packaging and deploying software and firmware updates in an enterprise Windows environment. Familiarity with application packaging tools (InstallShield, AdminStudio, or similar) is a plus. Experience with Lenovo System Update, Lenovo Thin Installer, or Lenovo Device Manager for firmware/driver management is preferred. Experience with macOS software packaging and deployment via Jamf (pkg, DMG, scripts) is a plus.

Attributes

Strong self-starter who identifies problems independently and drives them to resolution without waiting for direction. Demonstrated ability to manage and lead projects end-to-end, including planning, coordination, and delivery. Meticulous attention to detail in tracking compliance gaps and documenting findings. Excellent analytical and diagnostic skills, including the ability to trace complex deployment failures across multiple system layers on both Windows and macOS. Clear written and verbal communication skills, including the ability to translate technical compliance data into concise summaries for non-technical stakeholders. Collaborative and team-oriented, with the ability to work effectively across IT functions. Comfortable engaging directly with end users to understand compliance barriers, communicate expectations, and develop pragmatic solutions that improve deployment outcomes across the firm.

Qualifications

Ability to work independently under pressure, manage competing priorities, and meet strict deadlines. Comfortable operating in an environment where update timelines are driven by security and compliance requirements. Ability to see complex, multi-phase projects through to completion.

Working Conditions

Job is performed remotely but may require occasional travel into the office; is subject to time pressures and constraints and is often dependent on input from others.

The above statements are intended to describe the general nature and level of work being performed by persons assigned to this job. They are not intended to be an exhaustive list of all duties, responsibilities, qualifications and skills required of personnel so classified. The firm reserves the right to revise or modify this job description at any time.