Senior Intune Architect (Windows)

SGI; Województwo mazowieckie; Remote; PLN 524,000 - 699,000; Full time

Job summary

SGI is seeking a Senior Intune Architect to own the Intune workstream for a large Windows device migration. You will design the policy framework, co-management, and migration from GPO/SCCM to Intune, aligning with CIS benchmarks and building an Autopilot provisioning solution with Windows Hello for Business and security services.

The role is hands-on delivery, delivering end-to-end solutions, documenting runbooks, and supporting production rollout.

Qualifications

• 8+ years of Windows endpoint engineering experience.
• 5+ years hands-on Microsoft Intune experience.
• Experience deploying Intune for 10,000+ devices.
• Hands-on Windows Autopilot with Hybrid Entra ID Join.
• Experience migrating GPOs to Intune and CIS baselines.
• Knowledge of SCCM co-management and cutover troubleshooting.
• Experience with PKCS certificates, Windows Hello for Business, Entra LAPS, Defender for Endpoint, BitLocker, and Conditional Access.
• Ability to create build documentation and runbooks.

Responsibilities

• Deliver a standardized Intune policy framework for Windows 11 and apps.
• Complete GPO assessment and migration into Intune.
• Design and implement end-to-end Windows Autopilot solution.
• Implement Windows Hello for Business, Defender for Endpoint, and BitLocker.
• Test migrations, pilot deployments, and production rollout waves.
• Produce technical documentation and runbooks.

Skills

Windows endpoint engineering

Intune deployment

GPO migration

SCCM co-management

Autopilot design

CIS benchmarks

Job description

Location: Remote within Europe (CET working hours)
Start: ASAP
Contract: Initial 6-month contract with potential extension

This programme is transforming a global Windows estate of approximately 29,000 devices from on-premises management to Microsoft Intune.

The role has two key objectives:

• Transition all production devices from Group Policy and SCCM to Intune through co-management, replacing legacy GPOs with a standardized policy set aligned to CIS benchmarks, while ensuring migration, orchestration, and rollback processes are fully built and tested prior to deployment.
• Build, test, and validate a Windows Autopilot provisioning solution so that it becomes the standard method for deploying Windows devices, with Windows Hello for Business, compliance, and security services operational from first sign-in.

As the Senior Intune Architect, you will own the Intune workstream, including the standard policy framework, GPO analysis and migration to Intune, Autopilot design and implementation, and the delivery of identity and security services required for provisioning.

Working alongside a Senior Endpoint Engineer responsible for co-management, task sequences, application packaging, and deployment automation, you will play a key role in the successful delivery of the programme.

This is a hands-on delivery role. You will build, test, document, deploy, troubleshoot, and support solutions throughout the project lifecycle.

What You Will Deliver

• A standardized Intune policy framework for Windows 11, Microsoft Defender, Edge, and Microsoft 365 Apps, aligned to CIS benchmarks, with documented settings, approved exceptions, and phased retirement of legacy policies.
• A detailed GPO assessment and migration, ensuring required settings are rebuilt in Intune (including certificates, Wi‑Fi, OneDrive, local admin, Start Menu, Taskbar, proxy, and VPN configurations) and legacy policies can be safely retired at cutover.
• An end-to-end Windows Autopilot solution, including deployment profiles, ESP, Group Tags, OEM registration, existing device registration, and Hybrid Entra ID Join scenarios.
• Implementation of Windows Hello for Business, BitLocker, Entra LAPS, Defender for Endpoint, compliance policies, update rings, Intune RBAC, and Conditional Access in partnership with Security and IAM teams.
• Testing and support of migration activities, including policy transition, rollback procedures, pilot deployments, and production rollout waves.
• Complete technical documentation, including build notes, SOPs, runbooks, readiness evidence, and service desk knowledge articles.

What You Must Have

• 8+ years of Windows endpoint engineering experience and 5+ years of hands‑on Microsoft Intune experience.
• Proven experience building and deploying Intune solutions for 10,000+ Windows devices, including production rollout ownership.
• Hands‑on delivery of Windows Autopilot with Hybrid Entra ID Join, including Intune Connector for Active Directory and Enrollment Status Page (ESP) design.
• Experience implementing CIS or Microsoft security baselines through Intune Settings Catalog and migrating complex GPO environments to Intune.
• Strong knowledge of SCCM co‑management, workload transitions, and troubleshooting during cutover.
• Experience with PKCS certificates, Windows Hello for Business, Entra LAPS, Defender for Endpoint, BitLocker, and Conditional Access in hybrid identity environments.
• Proven ability to create build documentation, operational runbooks, and support handover materials for production services.

Nice to Have

Regulated environment. GlobalProtect pre-logon. Intune Suite. Graph and PowerShell for evidence. MD-102, MS-102 or SC-300. Important This is a hands‑on delivery role, not an advisory, architecture‑only, or support‑only position. Candidates should have personally delivered enterprise Intune implementations and migrations. Experience limited to support functions or environments smaller than 5,000 endpoints is unlikely to be suitable.

We believe in equal opportunity for all and actively encourage applications from diverse backgrounds, experiences, and perspectives.

Source Group International Ltd is acting as an Employment Business in relation to this vacancy