Windows Endpoint Resilience Engineer (Patch & Compliance)

Scotiabank; Toronto; On-site; CAD 100,000 - 150,000; Full time

Job summary

Scotiabank in Canada seeks a Windows Endpoint Resilience Engineer (Patch & Compliance) to design, deploy, and govern enterprise endpoint provisioning and patch management at scale. You will lead Autopilot provisioning, Intune enrollment, and third-party patching strategies while aligning with CIS benchmarks and security baselines.

The role emphasizes automation via PowerShell and Graph API, cross-team collaboration, and ensuring compliant deployment across thousands of workstations in a

Qualifications

• Bachelor’s degree in CS/IT/Engineering or equivalent practical experience.
• 5-8 years in endpoint engineering or platform engineering with ≥4 years hands-on Intune.
• Strong expertise in Microsoft Intune, Windows Autopilot, Entra ID, Conditional Access, and Windows Update for Business or Microsoft Autopatch.
• Experience implementing and managing enterprise-scale third-party patching solutions integrated with Intune (e.g., PatchMypc).
• Deep understanding of Windows servicing, Patch Tuesday, deployment rings, update governance, and vulnerability remediation.
• Experience delivering Win32 and MSIX packaging and app lifecycle management within Intune.
• Knowledge of CIS benchmarks, security baselines, device compliance policies, and endpoint security controls.
• Advanced PowerShell scripting and Microsoft Graph API automation/reporting.
• Experience in large regulated environments; financial services experience is an asset.
• Microsoft certifications such as MD-102, SC-300, AZ-104 are assets.
• Strong analytical, troubleshooting, stakeholder management, and communication skills.
• Spanish language proficiency is an asset.

Responsibilities

• Champion a customer-focused culture across enterprise platforms and partnerships.
• Design, implement, and support Windows Autopilot provisioning services and Intune enrollment.
• Lead patch management across Windows Update for Business, Autopatch, and related updates for ~94,000 workstations.
• Develop third-party patching capabilities integrated with Intune.
• Define and evolve standards for Company Portal and Intune app delivery.
• Implement CIS benchmarks, security baselines, and compliance controls.
• Lead troubleshooting for provisioning, patching, compliance, and enrollment services.
• Support tenant modernization including Intune adoption and co-management transitions.
• Advance platform maturity through automation with PowerShell, Graph API, Azure Automation.
• Partner with Cyber Security and other teams to embed Zero Trust and audit-ready processes.
• Ensure ITIL, change management, risk assessment, and incident response involvement.
• Contribute to a collaborative engineering culture focused on innovation.

Skills

Analytical skills

Troubleshooting

Stakeholder management

Communication skills

Spanish language proficiency

Education

Bachelor’s degree in Computer Science, Information Technology, Engineering, or equivalent

Tools

Microsoft Intune

Windows Autopilot

Entra ID

Microsoft Graph API

Azure Automation

PowerShell

Job description

Select how often (in days) to receive an alert:

Title: Windows Endpoint Resilience Engineer (Patch & Compliance)

Requisition ID: 268856

Join our team!

Would you like to complete your internship with an organization that has been in the market for more than 35 years, dedicated to improving our customers’ financial well-being through comprehensive and innovative solutions?

The Role: Technical Specialist Advisory, Modern Endpoint & Patch Engineering

Is this role right for you? In this role, you will:

• Champion a customer-focused culture that strengthens employee experience while leveraging enterprise platforms, partnerships, and technical expertise.
• Design, implement, and support Windows Autopilot provisioning services, including deployment profiles, Enrollment Status Page (ESP), dynamic group assignment, Autopilot Reset, pre-provisioning, Entra ID join, and Intune enrollment.
• Lead the enterprise cloud patch management practice across Windows Update for Business, Microsoft Autopatch, Microsoft 365 Apps, and driver and firmware updates. Establish deployment ring strategies that enable safe, predictable, and measurable updates across approximately 94,000 workstations globally.
• Develop and manage third-party application patching capabilities using enterprise patch management platforms integrated with Intune, ensuring alignment with vulnerability remediation objectives and security standards.
• Define and evolve enterprise standards for Company Portal and Intune application delivery, including packaging governance, application lifecycle management, self-service experiences, and targeting strategies.
• Implement and maintain CIS benchmarks, security baselines, and compliance controls in partnership with Cyber Security and OS Product teams, ensuring secure and consistent deployment at enterprise scale.
• Lead complex troubleshooting and root-cause analysis activities related to provisioning, patching, compliance, and enrollment services, driving permanent corrective actions and platform improvements.
• Support tenant modernization initiatives across subsidiary organizations, including Intune adoption, co-management transitions, and cloud endpoint management transformation programs.
• Advance platform maturity through automation and engineering best practices using PowerShell, Microsoft Graph API, Azure Automation, and other modern automation frameworks.
• Partner with Cyber Security, Identity, Networking, End User Services, and Operations teams to embed security-by-design principles, Zero Trust controls, and audit-ready processes.
• Ensure adherence to ITIL service management practices, change management standards, risk assessment requirements, and operational support commitments, including participation in major incident response and Patch Tuesday activities.
• Apply sound judgment and risk-based decision making while ensuring compliance with internal policies, regulatory requirements, and security controls.
• Contribute to a collaborative, high-performing engineering culture focused on innovation, accountability, continuous improvement, and technical excellence.

Do you have the skills that will enable you to succeed in this role? We'd love to work with you if you have:

• Bachelor’s degree in computer science, Information Technology, Engineering, or equivalent practical experience.
• 5-8 years of experience in endpoint engineering, modern device management, workplace technology, or platform engineering, including at least 4 years of hands‑on experience with Microsoft Intune.
• Strong expertise in Microsoft Intune, Windows Autopilot, Entra ID, Conditional Access, and Windows Update for Business or Microsoft Autopatch.
• Experience implementing and managing enterprise-scale third-party application patching solutions integrated with Intune such as PatchMypc.
• Deep understanding of Windows servicing, Patch Tuesday processes, deployment rings, update governance, and vulnerability remediation practices.
• Experience delivering and supporting Win32 applications, Microsoft Store applications, MSIX packaging, and application lifecycle management within Intune.
• Knowledge of CIS benchmarks, Microsoft security baselines, device compliance policies, and endpoint security controls.
• Advanced PowerShell scripting skills and experience leveraging Microsoft Graph APIs for automation and reporting.
• Experience working within large, regulated enterprise environments; financial services industry experience is considered an asset.
• Relevant Microsoft certifications such as MD‑102, SC‑300, AZ‑104, or equivalent certifications are considered an asset.
• Strong analytical, troubleshooting, stakeholder management, and communication skills.
• Spanish language proficiency is considered an asset and may support collaboration with LATAM‑based teams and subsidiaries.
• Cloud Endpoint Engineering and Patch Management Practice
• Windows Autopilot and Modern Provisioning
• Automation and Continuous Improvement
• Incident, Change, and Risk Management
• Product Mindset and Global Collaboration

What's in it for you?

• Diversity, Equity, Inclusion & Allyship-We strive to create an inclusive culture where every employee is empowered to reach their fullest potential, respected for who they are, and are embraced through bias‑free practices and inclusive values across Scotiabank. We embrace diversity and provide opportunities for all employee to learn, grow & participate through our various Employee Resource Groups (ERGs) that span across diverse gender identities, ethnicity, race, age, ability & veterans.
• Accessibility and Workplace Accommodations- We value the unique skills and experiences each individual brings to the Bank and are committed to creating and maintaining an inclusive and accessible environment for everyone. Scotiabank continues to locate, remove and prevent barriers so that we can build a diverse and inclusive environment while meeting accessibility requirements.
• Upskillingthrough online courses, cross-functional development opportunities, and tuition assistance.
• Competitive Rewards program including bonus, flexible vacation, personal, sick days and benefits will start on day one.
• Community Engagement - no matter where you choose to work from; we offer opportunities for community engagement & belonging with our various programs such as hackathons, contests, Humans of Digital and much more!

We are an international, modern, and digital bank.

Work‑life balance matters to us — we are the first bank in Chile to reduce the workweek to 39 hours!

Continuous learning and development — participate in projects, conferences, and events that help you build new skills and gain relevant knowledge.

We are diverse and inclusive.

At Scotiabank, inclusion is part of the way we do business. his opportunity is open in accordance with Law 21.015. If you require any reasonable accommodation to participate in the recruitment process, please let us know.