Senior Endpoint Engineer

This role defines the target state for how FERC devices are provisioned, managed, secured, and supported, and leads the engineering work to get there. The central mission is modernization: moving the fleet from a Config Mgr-centric, on-premises model to a cloud-native model built on Microsoft Intune, Entra , Windows Autopilot, and Windows Autopatch, aligned to federal Zero Trust requirements. The architect owns the roadmap, the design decisions, and the reference standards for that transition, while remaining hands-on with Config Mgr, Intune, Dell enterprise tooling, and Beyond Trust.

The position is an individual contributor with no supervisory duties. It leads through technical direction: setting standards, reviewing designs and changes, guiding engineers, and advising program leadership on endpoint risk, investment, and sequencing. Work is tracked in Service Now (operations and change) and Azure Dev Ops (ADO) Boards (roadmap, epics, and engineering backlog).

• Define and maintain the endpoint target-state architecture covering identity, provisioning, configuration, application delivery, update management, security, and support tooling.
• Own the multi-year endpoint modernization roadmap, with phases, dependencies, entry and exit criteria, and risk for each phase.
• Produce architecture artifacts: current- and target-state diagrams, design documents, architecture decision records (ADRs), and reference configurations.
• Evaluate new Microsoft and vendor capabilities, run proofs of concept, and recommend adoption, deferral, or retirement with cost, risk, and effort analysis.
• Define the user persona model, and set endpoint engineering standards for naming, policy design, assignment and filtering, app packaging, and baseline management, and enforce them through design and change review.
• Advise program leadership on endpoint risk, technical debt, licensing, and investment priorities.

• Lead the transition from Config Mgr to Intune, moving co-management workloads to Intune in planned waves using pilot groups and defined success criteria.
• Design and drive the move from hybrid join toward Entra  and zero-touch provisioning with Windows Autopilot, as described in the Windows Autopilot section.
• Modernize update management with Windows Update for Business and Windows Autopatch, including ring design, quality and feature update policy, and driver and firmware update policy.
• Move application delivery to Intune Win
  32 apps and catalog-based app management, and retire legacy packages and deployment methods.
• Replace on-premises dependencies with cloud services where approved, such as Windows LAPS, cloud-based certificate delivery, and Intune Remediations in place of Config Mgr scripts and baselines.
• Plan the reduction and eventual decommissioning of Config Mgr infrastructure, keeping only the services the roadmap still requires.
• Coordinate cutovers with the imaging, identity, network, security, and service desk teams, with tested rollback plans for each wave.
• Act as senior escalation point for Config Mgr, Intune, co-management, Autopilot, and Windows 11 client issues; resolve complex problems end to end.

• Design endpoint security configuration to meet NIST SP 800-53 controls, Microsoft security baselines, and applicable DISA STIG or CIS benchmarks.
• Support the program's Zero Trust work by defining device compliance signals for Entra Conditional Access, in partnership with the identity and security teams who own those policies.

• Build automation in Power Shell and the Microsoft Graph API for provisioning, configuration, compliance checks, and reporting.
• Develop KQL queries, SQL queries, and dashboards (SSRS, Power BI, or Intune and Endpoint Analytics reports) for operations, compliance, and leadership audiences.
• Define and report modernization metrics, such as share of devices on the target-state model, workloads moved, and legacy components retired.
• Analyze endpoint data to find trends, compliance gaps, and recurring failures, and turn findings into engineering fixes.

• Author and present change requests at the Change Advisory Board (CAB) for architecture-level and high-risk endpoint changes, and review changes submitted by other engineers.
• Plan and track roadmap work in ADO Boards as epics, features, and stories, linked to related Service Now records.
• Write and maintain SOPs, runbooks,…