Desktop Engineer

About Fortress

Fortress Investment Group LLC is a leading, highly diversified global investment manager with approximately $55 billion of assets under management as of December 31, 2025. Founded in 1998, Fortress manages assets on behalf of approximately 2,000 institutional clients and private investors worldwide across a range of credit and real estate, private equity and permanent capital investment strategies. Investment performance is our cornerstone - we strive to generate strong risk adjusted returns for our investors over the long term.

Fortress's Information Technology team seeks a skilled and well‑rounded Desktop Engineer to join the Desktop Engineering Group (DEG) full‑time. This is an end‑to‑end ownership role spanning the full desktop lifecycle — from image management and software packaging to patch management, configuration compliance, cloud platform management, virtualization, and security operations. You will be responsible for designing, implementing, and maintaining the firm's desktop infrastructure — ensuring it is secure, compliant, and optimized for performance, from the Windows OS and its core components to the platforms that manage and deliver the desktop experience  are looking for a thought leader who actively identifies trends and inefficiencies, and drives iterative, safely executed improvements that continuously raise the bar.

Every DEG team member is also responsible for security operations and plays an active role in protecting the environment.

• Desktop Engineering, Cloud & Modern Management Design, build, and maintain the enterprise Windows desktop environment across physical and virtual platforms, applying deep OS‑level knowledge to troubleshoot, optimize, and automate  and operate Microsoft Intune/Endpoint Manager across the full device lifecycle — policy management, compliance, application delivery, and configuration enforcement — while driving evolution toward cloud‑first management. Manage M365 integrations relevant to the desktop, including licensed application deployment and policy configuration.
  
  Develop automation and self‑healing remediation workflows to address configuration and version drift, keeping endpoints consistently compliant.

• Endpoint Operations — Image, Packaging, Patching & Monitoring Create and maintain desktop images for all user roles; manage task sequences, validate in staging, and ensure images remain current and compliant. Package, test, and distribute applications via SCCM, Intune, and Citrix. Enforce application control policies (App Locker/WDAC) and manage versioning in coordination with application owners. Own the full patch lifecycle — staging, testing, deployment, verification, and documentation — across OS, hardware, and software.
  
  Deploy and leverage end‑user experience monitoring tools (Nexthink or equivalent) to track endpoint health, surface trends, and drive proactive improvements.

• Desktop Security & Security Operations Administer endpoint security controls:
  Defender for Endpoint, Beyond Trust Privilege Management, Bit Locker, LAPS, WDAC, and App Locker. Monitor and respond to alerts via SIEM and Defender; participate in incident triage, investigation, remediation, and post‑incident review. Collaborate with the Sec Ops team on vulnerability management, threat detection, and pre‑deployment security reviews.

• Virtualization & Operations Deploy and manage virtual desktop environments (AVD, Windows 365, Citrix Xen App); monitor performance, support capacity planning, and assist with thin client strategy. Manage day‑to‑day operational tasks, track work in Service Now and Microsoft Planner, and serve as the Level 3 escalation point for complex desktop issues.

• Experience:
  
  5+ years of enterprise Windows desktop engineering, including design, deployment, and operations across physical and virtual environments.

• Education:
  
  Bachelor's degree in Computer Science, Information Technology, or equivalent experience.

• Technical Depth:
  Deep working knowledge of the Windows OS and the platforms that manage it — SCCM/Config Mgr, Intune/Endpoint Manager, M365, and endpoint security tooling…