Endpoint Engineer (Intune)

TIAG; Bethesda (MD); On-site; USD 95,000 - 115,000; Full time

Job summary

TIAG is hiring an experienced Endpoint Engineer (Microsoft Intune Specialist) to lead the modernization of our enterprise endpoint management for USU. The role focuses on migrating thousands of endpoints to Intune Modern Management and coordinating security-driven policies.

Qualified candidates will have DoD Secret clearance, MD-102 or equivalent, and 8570 IAM Level I baseline certifications, with hands-on Autopilot experience and zero-touch deployment goals.

Qualifications

• 5+ years of progressive IT engineering experience.
• Hands-on design, implementation, and administration of Intune and Autopilot.
• Active DoD Secret security clearance.
• MD-102 or equivalent modern endpoint management certification.
• DoD 8570 IAM Level I baseline certification (Security+ CE, CAP, CND, Cloud+, or GSLC).

Responsibilities

• Migrate 3,000+ endpoints from on-premise management to Intune Modern Management.
• Audit and map existing GPOs and SCCM configs to Intune profiles.
• Design endpoint security policies including BitLocker and FileVault enforcement.
• Configure Autopilot enrollment profiles for zero-touch deployment.
• Implement Co-Management strategy for Windows endpoints.
• Collaborate in Agile sprints with cross-functional modernization teams to integrate security.

Skills

Endpoint management

Microsoft Intune

Windows Autopilot

Zero-Touch deployment

Education

DoD IAM Level I baseline (8570.01-M)

MD-102 Endpoint Administrator certification

Tools

Intune

Windows Autopilot

Job description

Job Details: Job Location: Bethesda, MD 20814, Position Type: Full Time, Salary Range: $95,000.00 - $115,000.00 Salary/year, Travel Percentage: None, TIAG is hiring an experienced Endpoint Engineer (Microsoft Intune Specialist) to lead the modernization and transformation of our enterprise endpoint management environment in support of the Uniformed Services University (USU).

Position Responsibilities:

• Execute a comprehensive migration of 3,000 multi-OS enterprise endpoints from legacy on-premise management to Microsoft Intune Modern Management.
• Audit existing on-premise Group Policies (GPOs) and Microsoft Endpoint Configuration Manager (SCCM) configurations, collaborating closely with the SCCM Endpoint Engineer to map and migrate them accurately to modern Intune Configuration Profiles and Compliance Policies.
• Design and implement Endpoint Security policies for native disk encryption to ensure full enrollment of BitLocker for Windows and FileVault for macOS, managing secure recovery key escrow directly into Entra ID.
• Configure and validate Windows Autopilot and macOS automated enrollment profiles to establish a sustainable "Zero-Touch" deployment capability, verifying that 100 percent of the enterprise recovery keys and endpoints are securely managed within the Microsoft ecosystem.
• Execute and maintain a Co-Management strategy for all Windows endpoints to ensure seamless operational continuity with zero degradation of service during the cloud transition.
• Integrate with a cross-functional modernization team by participating in Agile sprints, architecture reviews, and operational planning to ensure cybersecurity is baked into the endpoint management lifecycle.

Qualifications: Required Experience

• Minimum of 5 years of overall progressive IT engineering experience, with at least 3 years of hands-on experience designing, implementing, and administering Microsoft Intune and Windows Autopilot
• Active DoD Secret Security Clearance required for consideration
• Active DoD 8570.01-M / 8140 IAM Level I baseline certification (such as Security+ CE, CAP, CND, Cloud+, or GSLC)
• Microsoft Certified: Endpoint Administrator Associate (MD-102) certification or an equivalent technical certification for modern endpoint management

TIAG is an equal opportunity employer and federal contractor or subcontractor.

Consequently, the parties agree that, as applicable, they will abide by the requirements of 41 CFR 60-1.4(a), 41 CFR 60-300.5(a), and 41 CFR 60-741.5(a) and employment decisions shall be based solely on merit and without regard disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations.

TIAG takes proactive steps to employ and advance in employment qualified individuals without regard to disability or protected veteran status.

The parties also agree that, as applicable, they will abide by the requirements and may be subject and required to take action pursuant to the following laws and accompanying regulations: The Vietnam Era Veterans Readjustment Assistance Act of 1974, as amended (and its implementing regulations at 41 C.F.R. 60-300); Section 503 of the Rehabilitation Act of 1973, as amended (and its implementing regulations at 41 C.F.R 60-741); and Executive Order 13496 (and its implementing regulations at 29 C.F.R. part 471, Appendix A to Subpart A).