Responsibilities

• Own and maintain the technical roadmap for endpoint provisioning, OS lifecycle, encryption, and mobile management.
• Set engineering standards, baselines, and best practices; drive consistency across the estate.
• Mentor and provide technical direction to junior and mid-level engineers; review their work and grow their capability.
• Lead design reviews, evaluate new tooling/approaches, and make architecture recommendations to the EUC Manager.

• Design and continuously improve zero-touch device provisioning using Windows Autopilot (Entra hybrid and Entra-joined).
• Own Autopilot profiles, configurations, deployment profiles, and dynamic grouping.
• Maintain provisioning quality, driver/firmware management, OEM relationships, and resolution of complex enrolment failures.

• Plan and lead Windows feature and EOL upgrade campaigns across the fleet.
• Own update rings, Windows Update for Business policies, and rollout strategy.
• Diagnose and develop repeatable remediation for upgrade failures (in-place upgrade blocks, hardening conflicts, disk/component issues).

• Set strategy and standards for iOS and Android enrolment, configuration, and compliance via Intune (BYOD and corporate-owned).
• Own app protection / MAM policies, certificate and Wi-Fi/VPN profiles, and mobile app deployment.

Requirements

• 7+ years in endpoint engineering / EUC, with a track record of owning a Windows fleet end-to-end at scale.
• Demonstrated experience leading workstreams and mentoring or technically guiding other engineers.
• Expert-level Microsoft Intune/SCCM administration across Windows and mobile.
• Deep, hands-on Windows Autopilot experience in production at scale.
• Proven ownership of Windows OS upgrade / EOL migration programmes from planning through delivery.
• Strong command of BitLocker, Entra ID, Conditional Access, and Windows compliance.
• Tanium (or SCCM / ConfigMgr) for endpoint management and patching.
• Advanced PowerShell scripting; comfortable automating against the Microsoft Graph API.
• Certifications such as Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) or equivalent; Microsoft 365 Certified: Administrator Expert (MS-102), SC-300, or SC-200 a plus.