Description

 Key Responsibilities

Device Management & Engineering

• Own and evolve Windows endpoint configuration across the global estate, with secondary responsibility for macOS.
• Manage and improve device provisioning through Windows Autopilot — deployment profiles, provisioning packages, enrollment status pages, and troubleshooting.
• Operate SCCM (Configuration Manager) as a legacy platform — ADRs, task sequences, and package replication — while driving its displacement in the move to Intune-first management.
• Build and maintain Intune policies, compliance profiles, and configuration baselines across Windows and macOS.
• Manage Group Policy as a legacy mechanism, reducing GPO dependency over time as configuration shifts to Intune.
• Package and deploy applications using PSADT or equivalent, with a focus on silent installs, rollback handling, and user communication.
• Support multi-vendor device transitions, ensuring zero-touch deployment and minimal end-user disruption.
• Lead hardware engineering for the fleet — evaluating, benchmarking, and certifying new laptop and desktop models against performance, security, and manageability criteria before they are approved for procurement.
• Own end-to-end patch management across the estate — monthly and out-of-band updates plus third-party patching — covering end-user devices (Intune, Windows Update for Business, SCCM) and the Windows server estate, with documented compliance reporting and exception handling.

Platform & Architecture

• Contribute to the design and continuous improvement of the end-user computing architecture, with a focus on standardization and scalability.
• Identify opportunities to centralize admin control, reduce technical debt, and consolidate tooling across the endpoint estate.
• Maintain and improve device health monitoring alongside Nexthink and Freshservice.

Vendor & Lifecycle Management

• Manage relationships with hardware vendors, ensuring correct SKU procurement, configuration standards, and regional requirements.
• Maintain device personas, refresh schedules, and fleet inventory — supporting regional and global refresh programs.
• Work with procurement and regional IT teams to ensure device ordering follows the global catalogue process.

Security, Identity & Compliance

• Own endpoint compliance and security posture in conjunction with our InfoSec team’s best practice.
• Ensure endpoint architecture supports Conditional Access, so devices are managed and compliant before accessing corporate resources, aligning device posture with InfoSec policy.
• Maintain and enforce security baselines aligned to CIS/NIST benchmarks across the Windows estate, enforced primarily through Intune.

Collaboration & Improvement

• Partner with help desk, infrastructure, and security teams to resolve escalated endpoint issues and drive permanent fixes.
• Document configuration standards, runbooks, and change procedures to a high standard.
• Contribute to service improvement, acting on trends in device performance, ticket data, and user feedback.

Required Skills & Experience

Essential

• Strong hands-on experience with Windows 11 endpoint management in an enterprise environment.
• Hands-on hardware evaluation — benchmarking and certifying enterprise laptop and desktop models (e.g. HP, Dell) and defining device acceptance criteria.
• Strong hands-on Intune experience — policy authoring, compliance profiles, app management, and configuration baselines across Windows and macOS, as the primary management platform.
• Hands-on Zscaler administration and management — ZIA and ZPA policy configuration via the admin portals, plus deploying and troubleshooting the Zscaler Client Connector (ZCC) on managed endpoints, including SSL inspection and always-on forwarding.
• Working knowledge of SCCM / MECM as a legacy platform — task sequences, software distribution, ADRs, and SCCM/Intune co-management.
• Experience with Windows Autopilot — deployment profiles, enrollment, and troubleshooting.
• Proven experience managing Windows feature-update cycles (22H2, 23H2, 24H2/25H2) across an enterprise estate using ring-based deployment, with compatibility testing and rollback planning.
• Demonstrable experience leading to migration from SCCM to Intune and Autopilot — co-management, workload transition, pilot ring design, and decommissioning of legacy SCCM infrastructure.
• Strong PowerShell scripting scripts, health-check automation, scheduled reporting, and Microsoft Graph integration for Intune and Entra ID.
• Ability to define, measure, and report against endpoint KPIs — patch compliance, provisioning success, encryption coverage, and feature-update adoption — and translate findings into clear documentation and stakeholder communication.
• Prior experience in a professional services environment (financial services, consulting, fintech, or law) where high standards of reliability, security, and user experience are expected.

Desirable

• Familiarity with macOS management via Intune or Jamf in a mixed-platform environment.
• Experience with device health and telemetry tooling (e.g. Nexthink) proactive alerting and CPU/memory/disk trend analysis.
• Understanding of Windows Hello for Business, BitLocker, and modern security baselines.
• Solid understanding of Microsoft Entra ID, device identity, and hybrid AD join.
• Experience transitioning from hybrid joined device environment to Entra joined device environment.
• Familiarity with mobile and non-Windows endpoint management via Intune — iOS, Android, Teams Rooms, and Teams Phone.
• Familiarity with structured IT project delivery — stakeholder updates, milestone tracking, and cross-team coordination.
• Exposure to VDI / Cloud PC platforms (Windows 365, Azure Virtual Desktop) alongside physical endpoint management.

Key Skills

Education

Bachelor's degree