Microsoft Endpoint Engineer (TS) — Remote in the US

Socket.dev; United States; Remote; USD 78,000 - 85,000; Full time

Job summary

DMI is seeking a Microsoft Systems SME to lead Windows endpoint engineering for a federal agency client. You will design, configure, and manage Windows workstations and endpoint management services across the enterprise with security and compliance in mind.

Lead the deployment of Intune policies, Autopilot provisioning, and patch management using Ivanti, KACE, and GPOs. Must hold Top Secret clearance and US citizenship for government work. Remote in the US is supported.

Qualifications

• Bachelor's degree in IT, cybersecurity, or related field preferred.
• 8+ years of experience in Information Technology, Endpoint Engineering, or Cybersecurity.
• 6+ years performing engineering (not help desk) functions in enterprise environments.
• Expert-level proficiency with Microsoft Intune, including compliance policies, configuration profiles, and conditional access.
• Hands‑on experience with Windows Autopilot for device provisioning and lifecycle management.
• Experience with Ivanti and/or KACE for OS and application patch management.
• Experience with Group Policy Objects (GPO) for Windows endpoint configuration and security enforcement.
• Experience implementing passwordless authentication and hardware-backed credentials.
• Experience working under formal change control, audit, and security governance processes.

Responsibilities

• Engineer and maintain secure Windows workstation images incorporating baselines, authentication agents, and VDI/remote access capabilities.
• Configure and maintain Microsoft Intune device compliance policies, configuration profiles, and conditional access requirements based on user role and device posture.
• Manage Windows Autopilot for automated device provisioning, registration, and lifecycle management.
• Implement and maintain OS and application patch management using Ivanti, KACE, and Intune/GPO-based orchestration; validate patches post-deployment and support rollback.
• Implement passwordless authentication and hardware-backed credentials, including YubiKey, CAC, and software keys for privileged and sensitive accounts.
• Maintain Windows device enrollment workflows and accurate asset inventory, including provisioning, reassignment, decommissioning, and secure wipe.
• Produce and maintain engineering documentation, runbooks, and change records for all Windows endpoint configurations.

Skills

Intune management

Windows Autopilot

Passwordless auth

GPO enforcement

Security governance

Hybrid identity

Active Directory

Change control

Education

Bachelor's degree preferred

8+ years IT/endpoint experience

Tools

Ivanti

KACE

Intune

Active Directory

Job description

DMI is seeking a Microsoft Systems SME to lead Windows endpoint engineering for a federal agency client. You will design, configure, and manage Windows workstations and endpoint management services across the enterprise with security and compliance in mind.

Lead the deployment of Intune policies, Autopilot provisioning, and patch management using Ivanti, KACE, and GPOs. Must hold Top Secret clearance and US citizenship for government work. Remote in the US is supported.