As a Staff Desktop Engineer, you will serve as the technical lead for the enterprise endpoint platform across Windows, macOS, iOS, Android, and Microsoft 365 environments. This role is responsible for defining endpoint architecture, establishing platform standards, solving complex escalations, and leading engineering initiatives that enable a secure, modern, and productive workforce. You will partner closely with Identity, Security, Network, and Governance teams while driving endpoint modernization efforts and mentoring technical staff through influence and expertise.
Responsibilities:
Own the architecture and standards for enterprise endpoint platforms, including:
Windows (Microsoft Intune, Autopilot, SCCM/MECM)
macOS (Jamf Pro, Apple Business Manager)
Design and manage device enrollment, configuration, compliance, application deployment, patch management, and lifecycle management across all supported platforms.
Lead mobile device management strategy for corporate-owned and BYOD iOS and Android devices using Intune and Apple Business Manager.
Establish standards for zero-touch provisioning and securing corporate data on personally owned devices.
Define and execute multi-quarter endpoint modernization roadmaps, including:
Intune and SCCM transition strategies
Modern macOS onboarding processes
Consolidation of acquisition-driven device fleets
Lead complex cross-functional endpoint initiatives from requirements gathering through rollout and operational handoff.
Define application packaging standards, deployment rings, rollback processes, and recurring operating system and security patching strategies.
Drive vulnerability remediation efforts utilizing endpoint telemetry and security tools including Qualys, CrowdStrike, and Jamf.
Partner with Identity, Security, Network, and GRC teams to implement and maintain secure endpoint controls leveraging:
Microsoft Entra ID
Okta
GlobalProtect/Prisma Access
Conditional Access and compliance frameworks
Translate security and regulatory requirements into enforceable endpoint configurations.
Automate endpoint operations using PowerShell, Bash, Python, Microsoft Graph APIs, and Jamf APIs.
Lead root cause analysis for recurring incidents and implement long-term corrective actions.
Mentor engineers and Service Desk personnel through reviews, standards development, documentation, and operational runbooks.
Serve as a senior technical individual contributor, providing leadership through expertise, architectural judgment, and influence.
Qualifications:
Required Qualifications:
8+ years of experience in desktop engineering, endpoint engineering, systems engineering, or related infrastructure roles.
Demonstrated technical leadership experience supporting complex enterprise endpoint platforms.
Production experience supporting both Windows and macOS environments.
Advanced hands-on experience with:
Microsoft Intune
Windows Autopilot
PowerShell
Enterprise application packaging and deployment
Advanced hands-on experience with:
Jamf Pro
Apple Business Manager
macOS device management and configuration
Experience managing enterprise iOS and Android environments, including:
Apple Device Enrollment (ADE)
Android Enterprise
Compliance policies
App protection policies
Device wipe and retirement workflows
Working knowledge of SCCM/MECM and Intune co-management or migration strategies.
Strong knowledge of identity and access management dependencies, including:
Okta
Entra ID
Active Directory
Certificates
Single Sign-On (SSO)
Multi-Factor Authentication (MFA)
Conditional Access
Experience implementing endpoint security controls such as:
Device encryption
Endpoint Detection and Response (EDR)
Vulnerability remediation
Compliance baselines
Strong scripting and automation experience with PowerShell and Bash, with working knowledge of Python and APIs.
Experience leading structured change management, incident management, and problem management processes.
Strong written and verbal communication skills with the ability to create architecture documentation, standards, operational runbooks, and executive-level technical communications.
Preferred Qualifications:
Experience integrating Microsoft Graph, Jamf, or ServiceNow APIs.
Experience with
Okta Verify
Okta FastPass
Windows Hello for Business
CrowdStrike
Qualys
Jamf Protect
Experience implementing macOS Declarative Device Management, FileVault escrow, or CIS benchmarks.
Experience administering Apple Business Manager and Android Enterprise environments at enterprise scale.
Experience supporting mobile threat defense integrations, activation lock management, ownership management, and automated mobile offboarding.
Experience in merger and acquisition (M&A), multi-tenant, or non-domain environments.
Experience leading major platform migrations such as endpoint management modernization initiatives, MDM transitions, or fleet consolidations.
Relevant certifications such as
Microsoft 365 Endpoint Administrator Associate
Jamf Certifications
ITIL Certifications
Equivalent practical experience
Tools and Technologies:
Microsoft Intune
Windows Autopilot
SCCM/MECM
Jamf Pro
Apple Business Manager
Microsoft Entra ID
Okta
Active Directory
GlobalProtect
Prisma Access
PowerShell
Bash
Python
Microsoft Graph API
Jamf API
CrowdStrike
Qualys
iOS
Android Enterprise
Windows Hello for Business
Jamf Protect
ServiceNow