Lead Endpoint & Security Engineer

JFC Staffing Companies; Lancaster (Lancaster County); On-site; USD 120,000 - 160,000; Full time

Job summary

JFC Staffing Companies is seeking a Lead Endpoint Engineer to build and lead our endpoint engineering function with a security-first mindset. You will partner with Security and Infrastructure leadership to implement, maintain, and improve endpoint controls across Windows endpoints.

This hands-on leadership role demands engineering excellence, mentorship of peers, and coordination with multiple teams to raise endpoint resilience and operational excellence across the enterprise.

Qualifications

• Extensive hands-on endpoint engineering experience in an enterprise IT environment.
• Experience administering Microsoft Intune at scale including Autopilot.
• Strong skills in Microsoft Defender for Endpoint and endpoint hardening.
• Familiarity with Active Directory and Entra ID identity concepts.
• Proven ability to mentor engineers and lead projects end-to-end.

Responsibilities

• Lead endpoint initiatives from design through implementation and handoff.
• Develop and maintain runbooks, standards, and documentation.
• Partner with Security, Infrastructure, and Support to improve resilience.
• Own Intune configuration, deployment, and update strategy.
• Guide encryption, device trust, and policy enforcement across endpoints.
• Manage multiple concurrent projects with CAB-based change control.

Skills

Hands-on endpoint engineering

Microsoft Intune at scale

Microsoft Defender for Endpoint

Active Directory / Entra ID

Lead endpoint initiatives

Mentor engineers

Troubleshooting & analytics

Multi-site coordination

Tools

Jira Service Management

Job description

Why This Opportunity?

We're excited to partner once again with one of our longest-standing client relationships. Over the past seven years, we've helped build and strengthen their IT organization by successfully placing 20+ technology professionals across Infrastructure, Security, Systems Administration, Networking, Leadership, and End User Computing.

This isn't a one-off recruiting engagement- we have established, direct relationships with the hiring managers and IT leadership team, giving us firsthand insight into the environment, technical roadmap, and what it takes to be successful within the organization. We know the team, the culture, and the challenges they're solving because we've helped them grow year after year.

As they continue investing in modern endpoint management and endpoint security, they're looking for a Lead Endpoint Engineer who can help shape the future of their endpoint environment while partnering closely with Security and Infrastructure leadership.

SUMMARY

We are seeking a Lead Endpoint Engineer to help build and lead our endpoint engineering function with a strong security-first mindset. This role will partner closely with the Security Manager to implement, maintain, and continuously improve endpoint security controls while leading the engineering, management, and lifecycle of our Windows endpoint environment.

This is a hands-on engineering and technical leadership role—not a ticket-only or break/fix position. You will lead endpoint initiatives from design through implementation, establish engineering standards, mentor other endpoint engineers, and partner across Security, Infrastructure, and Support to improve both endpoint security posture and operational excellence.

WHAT YOU WILL DO

Endpoint Security Engineering

• Partner closely with the Security Manager to deploy, implement, and operationalize endpoint security capabilities across Windows endpoints.
• Own day-to-day endpoint security posture, including vulnerability remediation, configuration compliance, policy enforcement, and remediation of security findings.
• Administer, maintain, and optimize endpoint security technologies including Microsoft Defender for Endpoint, attack surface reduction controls, device control, and application allowlisting workflows such as Carbon Black App Control-style processes.
• Maintain endpoint encryption and platform trust through BitLocker, Secure Boot, tamper protection, and device compliance policies.
• Support endpoint-related security initiatives by implementing security baselines, hardening standards, and configuration changes through Microsoft Intune.
• Develop and maintain repeatable operational runbooks, engineering procedures, and documentation supporting endpoint security operations.
• Partner with Security and Infrastructure teams to improve endpoint resilience, reduce organizational risk, and support security initiatives impacting managed devices.

Modern Endpoint Management

• Own and continuously improve Microsoft Intune administration, including configuration profiles, compliance policies, security baselines, application deployment, and device configuration.
• Lead Microsoft Autopilot enrollment and provisioning strategies, including support for shared devices and specialized deployment scenarios.
• Design, implement, and manage Windows update strategy, including update rings, feature updates, quality updates, rollout planning, reporting, and remediation.
• Drive endpoint standardization through consistent policy management, profile optimization, scoping strategy, documentation, and lifecycle management.
• Support endpoint application deployment and ongoing device management across the enterprise.
• Support thin client management and standards across multiple locations, including Dell/WYSE technologies where applicable.

Identity & Access Alignment

• Support endpoint-related identity integrations with Entra ID, including device identity, Conditional Access alignment, and device compliance requirements.
• Partner with Security and Infrastructure teams on endpoint-related identity initiatives, including MFA enablement and device compliance validation.
• Help ensure endpoint configurations support secure access to enterprise resources while maintaining a positive end-user experience.

Leadership, Change Management & Execution

• Lead and mentor other endpoint engineers by establishing engineering standards, reviewing technical changes, and providing guidance on endpoint technologies and best practices.
• Lead endpoint engineering initiatives from design through implementation, testing, validation, and operational handoff.
• Author, review, and implement changes through the formal Change Advisory Board (CAB) process.
• Manage multiple concurrent projects while coordinating timelines across Security, Infrastructure, and Support teams.
• Build and maintain technical documentation, engineering standards, operational procedures, and knowledge articles using Jira Service Management.

Operational Support

• Provide engineering support for complex endpoint issues and major incidents impacting business operations.
• Partner with Infrastructure and Support teams to improve reliability, reduce recurring issues, and implement long-term engineering solutions.
• Help troubleshoot urgent endpoint incidents with a focus on rapid recovery, root cause identification, and continuous improvement.

WHAT WE ARE LOOKING FOR

• Strong hands-on endpoint engineering experience in an enterprise environment (not solely service desk or escalation support).
• Proven experience administering Microsoft Intune at scale, including configuration profiles, compliance policies, security baselines, application deployment, and Microsoft Autopilot.
• Strong experience implementing and supporting endpoint security controls, including Microsoft Defender for Endpoint, endpoint hardening, vulnerability remediation, and policy enforcement.
• Experience supporting hybrid identity environments utilizing Active Directory and Entra ID, including device identity and Conditional Access concepts.
• Experience leading endpoint engineering initiatives and driving projects from planning through implementation.
• Ability to mentor other engineers, establish technical standards, and execute with minimal day-to-day direction.
• Strong troubleshooting and analytical skills with the ability to balance security, usability, and operational requirements.
• Experience supporting multi-site environments where operational urgency and coordination are critical.

NICE TO HAVE

• Experience supporting Dell/WYSE thin client environments.
• Experience working in manufacturing or production environments with low downtime tolerance.
• Experience leading enterprise initiatives such as Windows operating system upgrades, endpoint modernization efforts, carrier migrations, or acquisition integrations.
• Experience developing technical documentation, operational procedures, and engineering standards.