Job Title: Sr. Administrator – Endpoint management (Intune)
Location: Birmingham, UK (Hybrid, 3-4 days a month onsite)
Project Type: Fulltime Employment
Key Responsibilities:
Device Lifecycle & Provisioning:
* Design, configure, and maintain Autopilot (Windows) and Apple Business Manager/DEP (macOS/iOS) and Android Zero‑Touch enrolment for zero‑touch provisioning.
* Manage device enrolment profiles, device categories, dynamic groups, and scopes.
* Oversee device lifecycle: onboarding, ownership changes, break/fix, replacement, and secure deprovisioning/wipe/retire.
Configuration & Security Baselines:
* Create and maintain Configuration Profiles (Settings Catalog, Templates, Custom OMA-URI) for Windows, macOS, iOS/iPadOS, and Android.
* Implement Security Baselines, Attack Surface Reduction rules, BitLocker/FileVault encryption, local admin management, and firewall policies.
* Enforce Conditional Access in collaboration with Identity/Security teams; ensure device Compliance Policies align with CIS/NIST/ISO27001 policy intents.
Application & Patch Management:
* Package, test, deploy, and update Win32, MSI, Microsoft Store, Line-of-Business, VPP, Managed Google Play, and macOS packages.
* Manage Windows Update for Business (rings, feature deferrals, quality updates), macOS/iOS/Android OS update deferrals, and deadline enforcement.
* Maintain application catalogs, supersedence, dependencies, detection logic, and rollback procedures.
Monitoring, Operations & Support:
* Monitor device health, enrolment success, policy/app install success, and compliance posture via Intune reports, Endpoint analytics, and Log Analytics/KQL queries.
* Troubleshoot device configuration, app deployments, Autopilot/ABM/Zero‑Touch issues, and remediation via proactive remediations/PowerShell scripts.
* Provide Tier‑2/3 support, knowledge articles, and SOPs for Service Desk; handle escalations and problem management (RCA, corrective actions).
Governance, Compliance & Continuous Improvement:
* Maintain documentation for standards, policies, runbooks, and change records (CAB/ITIL).
* Assist with audits and evidence for compliance (encryption, patching, CA, device compliance).
* Drive continuous improvement: reduce deployment failures, optimize rings, enhance automation, and improve endpoint performance and battery health.
Collaboration & Projects:
* Partner with Security, Identity, Networking, and Collaboration teams on cross‑domain projects (e.g., Defender for Endpoint, Entra ID device identity, PKI, VPN/per‑app VPN).
* Support mergers/divestitures, hardware refresh, and OS migration programs.
* Contribute to endpoint standard images/configuration baselines and DR/BCP considerations.
Required Skills & Experience:
* 3–5+ years administering Microsoft Intune / MEM in medium/large environments (1,000+ endpoints preferred).
Strong hands‑on expertise with:
* Autopilot, ABM/DEP, Android Enterprise (Fully Managed/Work Profile).
* Configuration Profiles, Compliance Policies, Security Baselines, Proactive Remediations.
* Win32 app packaging (IntuneWin), detection rules, supersedence; macOS pkg, iOS VPP; Managed Google Play.
* Windows Update for Business, feature/ring strategies, update monitoring and remediation.
* Device encryption (BitLocker, FileVault), certificate deployment (SCEP/PKCS), Wi‑Fi/VPN profiles.
* Entra ID (Azure AD) device registration/join, Conditional Access, device filters/dynamic groups.
* Defender for Endpoint onboarding/policies (preferred).
* Scripting/automation with PowerShell (Graph API experience a plus).
* Solid understanding of network fundamentals (proxies, firewalls, egress), PKI, identity, and mobile OS management constructs.
* ITIL‑aligned operations: changes, incidents, problems, and release management.
* UK Security Clearance preferred (or should be eligible for Clearance)
Preferred Skills (Nice to Have):
* Experience with Co‑management or migration from ConfigMgr to Intune; Autopatch; Copilot for Security integrations.
* KQL for Log Analytics/Defender advanced hunting; Workbook/report building.
* Packaging tools (PSADT, IntuneWinAppUtil), custom detection scripts, remediation scripting.
* Exposure to ServiceNow/ITSM and CMDB integrations.
Certifications:
* Microsoft Certified: Enterprise Administrator Expert (via MS-102 + elective).
* MD-102: Endpoint Administrator Associate (or successor).
Key Attributes:
* Strong ownership and accountability.
* Excellent analytical and troubleshooting skills.
* Clear communication with both technical and non‑technical stakeholders.
* Ability to work under pressure during major incidents.
* Customer‑obsessed mindset with strong ownership and bias for action.
* Clear communicator able to translate technical detail into business outcomes.
* Methodical, documentation‑first approach; strong problem solving and RCA discipline.
* Collaborative team player across Security, Network, Identity, and Service Desk.