Staff Desktop Engineer

As a Staff Desktop Engineer, you will serve as the technical lead for the enterprise endpoint platform across Windows, macOS, iOS, Android, and Microsoft 365 environments. This role is responsible for defining endpoint architecture, establishing platform standards, solving complex escalations, and leading engineering initiatives that enable a secure, modern, and productive workforce. You will partner closely with Identity, Security, Network, and Governance teams while driving endpoint modernization efforts and mentoring technical staff through influence and expertise.

Responsibilities

• Own the architecture and standards for enterprise endpoint platforms, including:
• Windows (Microsoft Intune, Autopilot, SCCM/MECM)
• macOS (Jamf Pro, Apple Business Manager)
• Design and manage device enrollment, configuration, compliance, application deployment, patch management, and lifecycle management across all supported platforms.
• Lead mobile device management strategy for corporate-owned and BYOD iOS and Android devices using Intune and Apple Business Manager.
• Establish standards for zero-touch provisioning and securing corporate data on personally owned devices.
• Define and execute multi-quarter endpoint modernization roadmaps, including:
• Intune and SCCM transition strategies
• Modern macOS onboarding processes
• Consolidation of acquisition-driven device fleets
• Lead complex cross-functional endpoint initiatives from requirements gathering through rollout and operational handoff.
• Define application packaging standards, deployment rings, rollback processes, and recurring operating system and security patching strategies.
• Drive vulnerability remediation efforts utilizing endpoint telemetry and security tools including Qualys, CrowdStrike, and Jamf.
• Partner with Identity, Security, Network, and GRC teams to implement and maintain secure endpoint controls leveraging:
• Microsoft Entra ID
• Okta
• GlobalProtect/Prisma Access
• Conditional Access and compliance frameworks
• Translate security and regulatory requirements into enforceable endpoint configurations.
• Automate endpoint operations using PowerShell, Bash, Python, Microsoft Graph APIs, and Jamf APIs.
• Lead root cause analysis for recurring incidents and implement long-term corrective actions.
• Mentor engineers and Service Desk personnel through reviews, standards development, documentation, and operational runbooks.
• Serve as a senior technical individual contributor, providing leadership through expertise, architectural judgment, and influence.

Qualifications

Required Qualifications

• 8+ years of experience in desktop engineering, endpoint engineering, systems engineering, or related infrastructure roles.
• Demonstrated technical leadership experience supporting complex enterprise endpoint platforms.
• Production experience supporting both Windows and macOS environments.
• Advanced hands-on experience with:
• Microsoft Intune
• Windows Autopilot
• PowerShell
• Enterprise application packaging and deployment
• Advanced hands-on experience with:
• Jamf Pro
• Apple Business Manager
• macOS device management and configuration
• Experience managing enterprise iOS and Android environments, including:
• Apple Device Enrollment (ADE)
• Android Enterprise
• Compliance policies
• App protection policies
• Device wipe and retirement workflows
• Working knowledge of SCCM/MECM and Intune co-management or migration strategies.
• Strong knowledge of identity and access management dependencies, including:
• Okta
• Entra ID
• Active Directory
• Certificates
• Single Sign-On (SSO)
• Multi-Factor Authentication (MFA)
• Conditional Access
• Experience implementing endpoint security controls such as:
• Device encryption
• Endpoint Detection and Response (EDR)
• Vulnerability remediation
• Compliance baselines
• Strong scripting and automation experience with PowerShell and Bash, with working knowledge of Python and APIs.
• Experience leading structured change management, incident management, and problem management processes.
• Strong written and verbal communication skills with the ability to create architecture documentation, standards, operational runbooks, and executive-level technical communications.

Preferred Qualifications

• Experience integrating Microsoft Graph, Jamf, or ServiceNow APIs.
• Experience with:
• Okta Verify
• Okta FastPass
• Windows Hello for Business
• CrowdStrike
• Qualys
• Jamf Protect
• Experience implementing macOS Declarative Device Management, FileVault escrow, or CIS benchmarks.
• Experience administering Apple Business Manager and Android Enterprise environments at enterprise scale.
• Experience supporting mobile threat defense integrations, activation lock management, ownership management, and automated mobile offboarding.
• Experience in merger and acquisition (M&A), multi-tenant, or non-domain environments.
• Experience leading major platform migrations such as endpoint management modernization initiatives, MDM transitions, or fleet consolidations.
• Relevant certifications such as:
• Microsoft 365 Endpoint Administrator Associate
• Jamf Certifications
• ITIL Certifications
• Equivalent practical experience

Tools and Technologies

• Microsoft Intune
• Windows Autopilot
• SCCM/MECM
• Jamf Pro
• Apple Business Manager
• Microsoft Entra ID
• Okta
• Active Directory
• GlobalProtect
• Prisma Access
• PowerShell
• Bash
• Python
• Microsoft Graph API
• Jamf API
• CrowdStrike
• Qualys
• iOS
• Android Enterprise
• Windows Hello for Business
• Jamf Protect
• ServiceNow