Sr. Endpoint Engineer

HKS INC; Dallas (TX); On-site; USD 110,000 - 140,000; Full time

Job summary

HKS INC in Dallas, TX seeks an experienced patch and update management lead to oversee the monthly cycle for Windows, macOS, Windows Server, and firmware across ~2,500 devices in 28 locations. The role relies on Intune and MEM tooling, deployment rings, and test coordination.

You will remediate critical CVEs, manage device configurations, and collaborate with security to ensure compliance, drift reporting, and timely updates. Travel may be required.

Qualifications

• B.A./B.S. degree in Computer Science or related field or equivalent work experience.
• 6+ years of experience, 4+ years administering Microsoft Intune in a production enterprise environment.
• Advanced competency of Microsoft Endpoint Management technologies (MEM) including Intune, Autopilot, Azure Arc, Azure AD.
• Strong familiarity with CVE scoring, vulnerability scanners, and remediation SLA reporting.

Responsibilities

• Owns the monthly patch cycle for Windows and macOS endpoints and Windows Server designs.
• Maintains deployment rings (pilot, early adopter, broad) and coordinates tests for monthly patch publication.
• Patches third-party applications through Intune or patch management tools and manages firmware/BIOS updates.
• Meets remediation SLAs for critical/high CVEs and coordinates out-of-band patching; reports compliance and drift.
• Administers Intune across Windows, macOS, iOS/iPadOS and Android; handles enrollment and CA inputs.
• Onboards and manages Azure Arc servers to extend update management to on-premises and cloud.
• Maintains SCCM/MECM co-management and drives cloud native adoption; builds dashboards for leadership.

Skills

Intune

PowerShell

Microsoft Graph

Autopilot

Azure Arc

Azure AD

SCCM/MECM

Bash/zsh

Education

Bachelor's degree in Computer Science or related field

Tools

Intune

Autopilot

Azure Arc

Azure AD

SCCM/MECM

Microsoft Graph

Job description

Overview: Responsible for the enterprise patch and update management platform and the endpoint services supporting approximately 2,500 devices across 28 locations, spanning Azure and on-premises workloads. Leads the monthly patch cycle for Windows, macOS, Windows Server, and firmware, including deployment ring design, test coordination, and critical CVE remediation. Manages the device, application, policy, and security configurations to remain compliant. Partners across IT, leveraging Intune and other endpoint management tools to deliver endpoint solutions to the firm.

Responsibilities

Owns the monthly patch cycle for Windows and macOS endpoints and Windows Server Designs and maintains deployment rings (pilot, early adopter, broad), coordinating with test groups to validate patch levels for monthly publication Patches third-party applications (browsers, runtimes, 7zip, etc.) through Intune or a dedicated patch management tool Manages firmware, driver, and BIOS updates for laptops and server hardware Meets remediation SLAs for critical and high-severity CVEs, executes out-of-band emergency patching for actively exploited vulnerabilities, and reports on compliance, exceptions, and drift Partners with the security team on scan findings, false positives, risk acceptance, and remediation planning Packages, deploys, updates, and retires applications (Win32, MSIX, Store, macOS pkg/dmg) and drivers, including detection rules, dependencies, and supersedence Maintains a documented QA methodology for packages, patches, and configuration changes — test plans, acceptance criteria, and documented results before broad release Administers Intune across Windows, macOS, iOS/iPadOS, and Android, including enrollment (Autopilot, Apple Business Manager/ADE, Android Enterprise), configuration profiles, compliance policies, and Conditional Access inputs Onboards and manages servers in Azure Arc to extend update and configuration management on-premises and cloud servers Maintains SCCM/Intune co-management and drives cloud native adoption Maintains device and security baselines and hardening configurations Helps design, build, and document the patch and device management system end to end, including architecture, runbooks, and standard operating procedures Writes and maintains policies and standards for patching, update rings, device configuration, and application lifecycle Evaluates, pilots, and recommends tooling to close gaps in the current platform Automates operational work using PowerShell, Microsoft Graph, and bash/zsh Builds patch compliance and device health dashboards for IT leadership Submits and drives change requests for all production work, represents those changes at change advisory board review, and communicates maintenance windows, impact, and rollback plans Assists application owners and other IT teams with packaging, deployment, and patching Supports the service desk on escalated endpoint issues, patch-related breakage, and rollbacks Participates in scheduled after-hours maintenance and supports high-severity incidents after-hours Ensures all technology and departmental activities comply with company, security, regulatory and regional requirements Stays current with industry trends, technological advancements, and leverages these capabilities to improve and streamline the operation Travel may be required

Qualifications

B.A./B.S. degree in Computer Science or related field, or equivalent work experience Typically, with 6+ years of experience, with 4+ years of experience administering Microsoft Intune in a production enterprise environment Advanced competency of Microsoft Endpoint Management (MEM) technologies, including Intune, Autopilot, Azure ARC, AZURE AD Advanced competency of CVE/CVSS scoring, vulnerability scanner output, and remediation SLA reporting Working knowledge of SCCM/MECM, including co-management with Intune Experience with managing macOS in an enterprise environment, plus iOS and Android mobile device management Experience with third-party application patching using Intune integrations or a dedicated patch management tool Experience with application packaging and deployment (Win32, MSIX, macOS pkg/dmg) and with a documented QA and testing methodology Experience with scripting for automation: PowerShell required; Microsoft Graph and bash/zsh for macOS strongly preferred Experience with disciplined change management practice (ITIL-aligned) and a genuine willingness to write and maintain documentation and policy Experience in MS Office Suite Strong communication and interpersonal skills, with the ability to interact with all levels of staff Strong work ethic and eagerness to produce high quality, accurate results Ability to hold sensitive information with a high level of confidentiality and integrity Ability to present ideas in a clear, concise and professional manner both verbally and in writing Ability to proactively solve problems and apply innovative solutions Ability to collaborate in a team environment and ability to work independently Ability to prioritize competing demands Ability to effectively meet deadlines at expected quality Travel may be required

HKS is an EEO/AA Employer: M/F/Disabled/Veteran

We recommend selecting the location and/or country before selecting a job title when performing a search.

HKS is a global firm of architects, designers, planners and advisors who create places noted for their beauty and performance. Our 1,600 people in 29 offices are united by the belief that an environmental, social and governance approach to design achieves design excellence. In 2023, we became a carbon neutral firm. We value honesty, diversity and inclusion and we celebrate creative thinking. In partnership with our clients and collaborators, we craft powerful ideas and solutions. Together we create places that stand apart. HKS, Inc. provides reasonable accommodation in its application process for qualified individuals with disabilities.

For more information on what the Equal Employment Opportunity law encompasses, please click on the following links: EEO is the Law and Supplement. The following link is the Pay Transparency Nondiscrimination policy statement.