Windows Device Engineering Lead

Scorpion Therapeutics; Exton (PA); On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

Medical/dental/vision insurance

401(k) match

Disability & life insurance

Tuition reimbursement

Volunteer time off

Holiday & vacation

Job summary

Scorpion Therapeutics in Exton, PA seeks a Lead Windows Endpoint Manager to oversee global device lifecycle, patching, and security hardening. You will coordinate a distributed contractor team and drive modernization from Intune/SCCM toward Autopilot/co-management.

The role requires 7+ years of enterprise Windows experience, global fleet oversight, and leadership of technical teams. 24/7 IT operations experience is preferred. This position is on-site in Exton, PA.

Qualifications

• 7+ years enterprise Windows endpoint management (10,000+ endpoints).
• Experience managing global multi-geo Windows fleet.
• 3+ years leading/coordinating technical teams (offshore/nearshore).
• 24/7 global IT operations experience preferred.

Responsibilities

• Architect and improve Windows management using Intune and SCCM/MEMCM.
• Own baselines, enrollment profiles, compliance policies, and conditional access.
• Drive modernization to Autopilot/Intune-only/co-management.
• Oversee provisioning, imaging/refresh, and decommissioning.
• Run monthly Patch Tuesday cycles with planning and deployment.
• Manage WSUS/SUP, Intune Update Rings, Windows Autopatch; ensure SLA/SLO.
• Partner with Security Ops to remediate critical/high vulnerabilities within SLO.
• Develop/peer-review automation PowerShell scripts (Intune/Graph, reporting).
• Lead Win32 app packaging (Intune), MSI/MSIX transforms, SCCM packages.
• Lead offshore contractors, mentor, maintain docs, KPI reporting, CAB participation.

Skills

Microsoft Intune

SCCM/MEMCM

PowerShell

Windows endpoint management

CIS benchmarks

Microsoft Defender for Endpoint

Tools

ServiceNow

Sentinel/Defender XDR

Entra ID/Conditional Access

Job description

Position Summary

Lead global endpoint management for ~50,000 Windows devices worldwide across the full lifecycle (provisioning/configuration, monthly patching, security hardening, decommission) while coordinating a distributed contractor team.

Key Responsibilities

• Endpoint Management & Strategy

  • Architect and improve Windows management using Microsoft Intune and SCCM/MEMCM (co-management/cloud-only).
  • Own baselines, enrollment profiles, compliance policies, and conditional access.
  • Drive modernization to Autopilot/Intune-only/co-management.
  • Oversee provisioning, imaging/refresh, and decommissioning.

• Patching & Vulnerability Management

  • Run monthly Patch Tuesday cycles (planning, ring-based deployment, remediation tracking, reporting).
  • Manage WSUS/SUP, Intune Update Rings, Windows Autopatch; ensure SLA/SLO compliance.
  • Partner with Security Ops to remediate critical/high vulnerabilities within SLO windows.

• Security Policy & Compliance (CIS & MDE)

  • Implement/enforce CIS Windows benchmarks (Level 1/2) via Intune/SCCM.
  • Deploy/configure Microsoft Defender for Endpoint (onboarding, ASR rules, tamper protection, TVM).
  • Report CIS compliance and remediate drift; tune Intune compliance/conditional access for Zero Trust.

• PowerShell & Application Packaging

  • Develop/peer-review automation PowerShell (Intune/Graph, reporting, inventory, drift detection).
  • Lead Win32 app packaging (Intune), MSI/MSIX transforms, SCCM packages/task sequences.

• Team Leadership & Governance

  • Lead offshore contractors (planning, SLAs/runbooks, mentorship), maintain documentation, produce KPI reporting, participate in CAB, and represent endpoint team cross-functionally.

Required Qualifications

• 7+ years enterprise Windows endpoint management (10,000+ endpoints).
• Experience managing global multi-geo Windows fleet.
• 3+ years leading/coordinating technical teams (offshore/nearshore).
• 24/7 global IT operations experience preferred.

Must-Have Technical Skills

• Microsoft Intune, SCCM/MEMCM, advanced PowerShell, application packaging, CIS benchmarks, Microsoft Defender for Endpoint.

Strong Plus / Preferred

• Autopatch/Autopilot scenarios; Entra ID/Conditional Access; IT analytics reporting; ITSM (ServiceNow); Sentinel/Defender XDR; ITIL; MD-102/SC-200; regulated-industry compliance; other EDR tools.

Benefits (if eligible)

• Medical/dental/vision, 401(k) match, disability/life insurance, tuition reimbursement, paid volunteer time off, holidays, sick time (up to 80 hrs/yr), paid vacation (up to 120 hrs for new hires).