Endpoint Engineering Lead

Job Description

Endpoint Engineering Lead to lead the Enterprise Endpoint Infrastructure Management (desktop engineering) team for a Department of War agency, responsible for thousands of endpoints across Pre-Production, NIPRNet, SIPRNet, and JWICS enclaves. The Lead owns the technical strategy and daily direction of MECM/SCCM engineers, application packaging, imaging, patch, and STIG/compliance engineers; is accountable for CAT I/II/III patch compliance, hardened image compliance, and Group Policy configuration control; leads the Digital Twin evaluation and implementation so no significant change reaches production untested; and serves as the Tier III/IV engineering authority for enterprise-wide endpoint incidents. This role partners with the Tier II/Deskside Lead, cybersecurity, and RMF teams. This is a salaried, FLSA-exempt position in which you will independently analyze situations, determine the appropriate course of action, and exercise discretion and independent judgment on matters of significance to the program and its customers.

Duties and responsibilities:

Engineer, operate, and maintain the MECM/SCCM infrastructure across enclaves: hierarchy and site heaLead and direct the endpoint engineering team (MECM/SCCM engineers, application packaging, imaging/deployment, patch management, STIG/compliance), including work prioritization, technical review, mentoring, and coordination with the Tier II/Deskside Lead and Service Desk.

Own the endpoint engineering roadmap and standards: endpoint management platform architecture, hardened image strategy, Group Policy and configuration baseline governance, automation and provisioning design, and pre-production/Digital Twin test-before-deploy practice.

Author the Digital Twin Evaluation and Implementation Plan (within 120 days of award) and lead its phased implementation, cost-benefit analysis, and adoption as the mandatory validation gate for significant network and system changes.

Be accountable for CAT I/II/III patch compliance, image STIG compliance, and time-to-remediate metrics reported to the Customer Support Metrics Dashboard, and lead endpoint After-Action Reviews and Root Cause Analyses.

Lead the engineering design, implementation, and lifecycle of the enterprise endpoint infrastructure: hardened image pipelines, automated provisioning, endpoint management platform architecture (MECM/SCCM, Intune), configuration baselines, and VDI integration across all enclaves.

Lead the evaluation, cost-benefit analysis, and phased implementation of the Digital Twin capability for network and system modeling; author the Digital Twin Evaluation and Implementation Plan; and establish the practice that every significant change is tested in the digital replica before deployment.

Lead engineering for AI, automation, and analytics initiatives approved by the Government, including predictive analytics on service data, intelligent automation across support tiers, and integrations with the ITSM platform, and deliver Proof of Concept Reports documenting feasibility, risks, and benefits.

Conduct market research and produce Market Research Reports and Rough Orders of Magnitude (ROMs) for emerging technologies and proposed solutions to support Government planning and IT Capability Request analysis.lth, distribution points, boundaries and boundary groups, collections, client health remediation, role-based administration, and reporting.and maintain automated deployment.

Requirements:

Bachelor's degree and a minimum of 10 years of related experience (a Master's degree with 8 years of related experience, or an additional 4 years of related experience in lieu of a degree, may be substituted).

Must be a U.S. Citizen.

Must have an Active Top Secret Clearance with SCI eligibility (favorably adjudicated T5/T5R) to start.

Must be within investigation scope and/or currently enrolled in Continuous Evaluation / Continuous Vetting.

Must possess and maintain a current DoD 8570/8140 IAT Level III baseline certification (e.g., CASP+ CE, CISSP or Associate, CCNP Security, GCED, or GCIH).

Demonstrated ability to work independently, analyze problems, determine the appropriate course of action, and exercise discretion and independent judgment with limited day-to-day supervision.

Minimum of 10 years of experience in systems or infrastructure engineering for enterprise Windows environments, including lead-engineer responsibility for endpoint or infrastructure programs at 10,000+ device scale.

Expert knowledge of MECM/SCCM and/or Intune architecture, Windows Server, Active Directory, Group Policy, virtualization (VMware/Hyper-V), VDI, and PowerShell automation.

Demonstrated experience designing and leading implementation of lab, pre-production, or digital twin environments and formal test-before-deploy practices.

Experience leading proof-of-concept evaluations, market research, and cost-benefit/ROM development for Government or enterprise decision-makers.

Extensive experience with DISA STIGs, ACAS/Nessus, RMF control implementation, POA&Ms, and eMASS.

Experience leading engineering teams, establishing standards, and executing changes through formal Change Management.

Excellent technical writing, briefing, and stakeholder communication skills; ability to participate in after-hours emergency on-call response.

Desired:

CISSP, CASP+ CE, or GCED; Microsoft 365 Certified: Administrator Expert; VMware VCP/VCAP; AWS or Azure architect certification.

Experience supporting Department of War (DoW), DoD, or Intelligence Community environments across NIPRNet, SIPRNet, and JWICS enclaves.

Experience applying AI/ML, RPA, or AIOps to IT service management and endpoint operations, including ServiceNow integrations.

Familiarity with DoD Zero Trust Strategy and Reference Architecture, DoDAF 2.02, DoD ICAM Strategy, and Technology Business Management (TBM).

ITIL 4 Foundation or Managing Professional; PMP.

Experience supporting IT Capability Request (ITCR) analysis and governance briefings.

Location:

Quantico, VA

Clearance:

Top Secret