Endpoint Systems Engineer

Endpoint Systems EngineerAs an Endpoint Systems Engineer, you will be responsible for designing, implementing, maintaining, and securing the enterprise workstation and mobile endpoint estate, including Windows, macOS, and iOS devices managed through Microsoft Intune. This role owns operating system and third-party application patching, OS lifecycle management, software packaging and deployment, Group Policy (GPO) and Intune policy administration, configuration baselines, and endpoint security tooling across on-premises, cloud-managed, and remote endpoints in a regulated financial services environment.ResponsibilitiesDesign, implement, maintain, and secure enterprise workstation and mobile endpoint environments, including Windows, macOS, and iOS devices managed through Microsoft Intune.Administer, maintain, and optimize Tanium as the primary endpoint management and patching platform, including module configuration, sensor/package authoring, content distribution, and operational reporting.Develop and execute enterprise patching strategies for Windows and macOS OS and third-party applications, including Patch Tuesday cycles, out-of-band releases, and zero-day remediation.Coordinate patch testing, pilot rings, phased deployments, validation, and rollback procedures across on-site and remote/VPN workstations.Package, test, and deploy enterprise applications for Windows, macOS, and iOS using Tanium Deploy and Microsoft Intune, maintaining a curated software catalog.Manage endpoint provisioning and enrollment workflows for Windows Autopilot, macOS Automated Device Enrollment, and iOS ADE, including driver libraries and zero-touch provisioning.Own the lifecycle management of Group Policy Objects and Microsoft Intune policies, including configuration profiles, compliance policies, security baselines, and endpoint protection policies.Design, test, deploy, troubleshoot, and tune policies in line with CIS-based standards and business needs.Develop automation scripts for provisioning, deployment, patch orchestration, health checks, and reporting using PowerShell, Python, Bash, and Tanium sensors/packages.Oversee workstation lifecycle activities such as provisioning, upgrades, decommissioning, and asset reconciliation.Partner with cybersecurity to analyze vulnerability scans and prioritize remediation efforts.Provide Tier 3 support for complex endpoint and software deployment issues, conducting root cause analysis and implementing solutions.Participate in platform upgrades and migrations, including system rollouts and major OS version transitions.Maintain technical documentation, runbooks, standards, procedures, and change records.Collaborate with cross-functional teams to ensure secure, resilient, and high-performing endpoint services.Requirements4 to 6 years of enterprise endpoint engineering experience, including administrator experience with Tanium and Microsoft Intune.Strong knowledge of Group Policy (GPO), Intune policy administration, and third-party application patching.Experience with scripting languages such as PowerShell, Python, and Bash.Experience troubleshooting Tier 3 support issues related to endpoints and deployment.Experience with SCCM/MECM, Kaseya VSA, or similar platforms is a plus.A 4-year degree in Information Systems, Computer Science, Computer Engineering, or a related field is preferred.Equivalent certifications or experience will be considered.Experience working in regulated industries such as financial services, healthcare, or government is strongly preferred.