Windows Client Engineer - Hybrid Pittsburgh

A.C. Coy; United States; Hybrid; USD 90,000 - 150,000; Full time

Job summary

A.C. Coy is seeking a Windows Client Engineer to manage and modernize the Windows endpoint estate using Microsoft Intune and SCCM. The role emphasizes reducing vulnerability risk and hands-on remediation development.

Responsibilities include handling Tenable findings, packaging updates, and ensuring patch compliance across the fleet while maintaining security baselines and supporting co-management within the enterprise environment.

Qualifications

• Experience engineering and administering Windows endpoints in an enterprise environment - 3-5 years.
• Hands-on experience with Microsoft Intune and SCCM including application packaging and deployment.
• Strong PowerShell scripting skills for automation, detection, and remediation.
• Experience with Windows patch management (Windows Update for Business, WSUS, or SCCM updates).
• Familiarity with vulnerability management concepts and Tenable experience preferred.
• Understanding of CVEs, CVSS scoring, and how vulnerability findings map to remediation actions.
• Knowledge of Windows OS internals, Active Directory, Group Policy, and Entra ID (Azure AD).
• Ability to test changes carefully and roll out fixes without disrupting end users.
• Experience with application packaging tools (PSADT, PatchMyPC) and MSI/MSIX - Preferred.
• Exposure to Microsoft Defender for Endpoint and its vulnerability management (TVM) integration - Preferred.
• Knowledge of security hardening frameworks (CIS Benchmarks, DISA STIGs) - Preferred.

Responsibilities

• Windows Client Engineer to manage and modernize the Windows endpoint estate through Intune and SCCM, focusing on reducing vulnerability risk.
• Review vulnerabilities identified by Tenable Nessus / Tenable Security Center and own the endpoint remediation workflow from finding to closure.
• Build, test, and deploy remediation packages using Intune and SCCM - updates, patches, registry changes, scripted fixes.
• Author and maintain remediation scripts (PowerShell), including detection and remediation logic for Intune proactive remediations and SCCM items.
• Package and deploy third-party updates outside standard patching (Win32 in Intune, SCCM deployments, PatchMyPC).
• Manage Windows Update policy via Windows Update for Business / WSUS / SCCM groups; ensure accurate patch compliance reporting.
• Partner with security team to triage findings, validate fixes clear the vulnerability, and provide feedback on false positives.
• Track remediation progress and report on compliance, patch coverage, and outstanding risk against SLAs.
• Maintain configuration baselines and security hardening (CIS/DISA STIG alignment) across the Windows client fleet.
• Support co-management, device onboarding, compliance policies, and conditional access within the Intune/SCCM environment.
• Document remediation procedures and contribute to repeatable deployment processes to avoid production breaks.

Skills

PowerShell scripting

Intune

SCCM/Configuration Manager

Automation

Vulnerability remediation

Patch management

Windows OS internals

Active Directory

Entra ID (Azure AD)

Testing & risk-free deployment

Defender for Endpoint integration

Education

Bachelor's degree or equivalent experience

Tools

Tenable Nessus

Tenable Security Center

Windows Update for Business

WSUS

PatchMyPC

PSADT

MSI/MSIX packaging

CIS Benchmarks

DISA STIGs

Intune

Job description

Overview

Location: Hybrid in Pittsburgh., PA (3 days onsite, 2 days remote)

Job Type: Full Time / Contract

Work Authorization: No Sponsorship

Responsibilities

• Windows Client Engineer to manage and modernize the Windows endpoint estate through Microsoft Intune and SCCM (Configuration Manager), with a primary focus on driving down vulnerability risk. This is a hands-on engineering role: partner closely with the security team to review findings from Tenable, translate them into deployable fixes, and build the packages, scripts, and configuration baselines that remediate them at scale.


• Review outstanding vulnerabilities identified by Tenable Nessus / Tenable Security Center and own the endpoint-side remediation workflow from finding to closure


• Build, test, and deploy remediation packages and solutions using Intune and SCCM - application updates, patches, registry and configuration changes, and scripted fixes


• Author and maintain remediation scripts (PowerShell), including detection and remediation logic for Intune proactive remediations and SCCM configuration items


• Package and deploy third-party application updates that fall outside standard Microsoft patching (e.g., via Win32 apps in Intune, application deployments in SCCM, or a patching tool like PatchMyPC)


• Manage Windows Update policy through Windows Update for Business / WSUS / SCCM software update groups, and ensure patch compliance reporting is accurate


• Partner with the security/vulnerability management team to triage findings, validate that deployed fixes actually clear the vulnerability, and provide feedback on false positives


• Track remediation progress and report on compliance, patch coverage, and outstanding risk against SLAs


• Maintain configuration baselines and security hardening (e.g., CIS/DISA STIG alignment) across the Windows client fleet


• Support co-management, device onboarding, compliance policies, and conditional access as part of the broader Intune/SCCM environment


• Document remediation procedures and contribute to a repeatable, well-tested deployment process to avoid breaking production

Qualifications

Education:

Bachelor's degree or equivalent experience

Certifications:

Microsoft MD - 102, SC - 200, or CompTIA Security+ - Preferred

Responsibilities:

• Experience engineering and administering Windows endpoints in an enterprise environment - 3-5 years


• Hands-on experience with both Microsoft Intune and SCCM/Configuration Manager, including application packaging and deployment


• Strong PowerShell scripting skills for automation, detection, and remediation


• Experience with Windows patch management (Windows Update for Business, WSUS, or SCCM software updates)


• Familiarity with vulnerability management concepts and tooling - Tenable experience strongly preferred; comparable tools (Qualys, Rapid7) also relevant


• Understanding of CVEs, CVSS scoring, and how vulnerability findings map to real remediation actions


• Solid grasp of Windows OS internals, Active Directory, Group Policy, and Entra ID (Azure AD)


• Ability to test changes carefully and roll out fixes without disrupting end users


• Experience with application packaging tools (PSADT, PatchMyPC) and MSI/MSIX - Preferred


• Exposure to Microsoft Defender for Endpoint and its vulnerability management (TVM) integration - Preferred


• Knowledge of security hardening frameworks (CIS Benchmarks, DISA STIGs) - Preferred