Modern Desktop Engineer

Shop2Shop; Stellenbosch; Hybrid; ZAR 600,000 - 900,000; Full time

Job summary

Shop2Shop is seeking a Modern Desktop Engineer to support, secure, and continuously improve our endpoint environment across Windows, macOS and mobile platforms. You will drive provisioning, configuration, compliance and lifecycle management using Intune, Autopilot and Apple Business Manager.

You will focus on policy enforcement, automation, and collaborating with security and IT teams to reduce incidents while improving user experience and device reliability.

Qualifications

• Bachelor-level IT qualification or equivalent practical experience.
• 4–6 years of enterprise endpoint experience preferred.
• Hands-on with Intune, Autopilot and modern device management.
• Experience deploying apps, OS updates and third-party patches.
• Experience implementing Defender, BitLocker, FileVault or Windows LAPS.

Responsibilities

• Provision and configure Windows and macOS devices using automated deployment methods.
• Manage Windows Autopilot, Apple Business Manager and zero-touch provisioning.
• Maintain standard device builds, configuration profiles and provisioning documentation.
• Coordinate device replacement, decommissioning, secure wiping and disposal.
• Configure and maintain device policies via Intune and related platforms.
• Monitor and enforce security baselines and compliance signals.
• Package, test and deploy business applications to endpoints.
• Coordinate OS upgrades, security updates and third-party patches.
• Monitor deployment results and resolve failures.
• Provide second-line troubleshooting and support for endpoints and apps.

Skills

Windows & macOS administration

Intune management

Autopilot & DEP

Zero-touch provisioning

Endpoint security (Defender/BitLocker)

Policy compliance & CIS baselines

Application packaging & deployment

OS updates & patch management

Troubleshooting across OS & apps

Automation & scripting mindset

Education

Relevant IT diploma or degree

Microsoft Endpoint Administrator certification

Tools

Microsoft Intune

Windows Autopilot

Apple Business Manager

Microsoft Defender for Endpoint

BitLocker

FileVault

LAPS

Azure Active Directory

Job description

Role Purpose

The Modern Desktop Engineer is a hands‑on technical role responsible for supporting, securing and continuously improving Shop2Shop’s endpoint environment across Windows, macOS and supported mobile platforms.

You will focus on device provisioning, configuration, compliance, application delivery, operating system management and endpoint security using platforms such as Microsoft Intune and Apple Business Manager. You will help provide users with a consistent and secure device experience while improving automation, supportability and lifecycle management across the endpoint estate.

You’ll thrive in this role if…

• You believe a well‑built device is invisible to the user, and you take pride in making that true at scale
• You're comfortably OS‑agnostic; you respect both Windows and macOS and enjoy the quirks of each
• You'd rather fix the root cause once than reset the same device ten times; good baselines and automation are your default
• You troubleshoot methodically: reproduce, check the logs, isolate, fix, document
• You keep a fleet in order without losing the plot; patch cycles, compliance and inventory don't slip on your watch
• You have empathy for the person behind the ticket and can explain a policy without sounding like one
• You like enabling first‑line teams so common issues never reach you twice

What You Will Do

Endpoint Provisioning and Lifecycle Management

• Provision and configure Windows and macOS devices using automated deployment methods.
• Manage Windows Autopilot, Apple Business Manager and zero‑touch provisioning processes.
• Maintain standard device builds, configuration profiles and provisioning documentation.
• Coordinate device replacement, decommissioning, secure wiping and disposal.

Endpoint Configuration and Compliance

• Configure and maintain device policies through Microsoft Intune and related management platforms.
• Implement security baselines aligned with organisational and CIS requirements.
• Monitor device compliance and address configuration or enrolment failures.
• Maintain device compliance signals that feed Conditional Access, working with the Microsoft 365 & Identity Engineer.
• Manage encryption controls, including BitLocker and FileVault.

Application and Update Management

• Package, test and deploy business applications to managed endpoints.
• Manage operating system upgrades, security updates and feature releases.
• Coordinate third‑party software patching and application lifecycle activities.
• Monitor deployment results and resolve update or installation failures.

Endpoint Security

• Configure and maintain endpoint controls within the Microsoft Defender stack.
• Manage local administrative access and endpoint privilege controls, including LAPS.
• Work with the Security Operations Analyst to remediate endpoint vulnerabilities.
• Support containment and remediation activities during endpoint security incidents.

Technical Support and Troubleshooting

• Provide second‑line support for endpoint, operating system and application issues.
• Investigate recurring device problems and implement permanent corrective actions.
• Coordinate warranty repairs, vendor support and hardware escalations.
• Develop support documentation and enable first‑line support teams to resolve common issues.

Asset and Endpoint Service Management

• Maintain accurate hardware and software inventory records.
• Support asset lifecycle processes from procurement through deployment and disposal.
• Monitor endpoint health, configuration status and software compliance.
• Identify opportunities to improve device reliability, user experience and deployment automation.

What You’ll Need to Succeed

• Strong knowledge of Windows endpoint administration, with practical exposure to macOS management.
• Experience with Microsoft Intune, Windows Autopilot and modern device‑management practices.
• Understanding of endpoint security, compliance policies, encryption and security baselines.
• Experience packaging and deploying applications, operating‑system updates and third‑party patches.
• Strong troubleshooting skills across devices, operating systems, applications and user configurations.
• An automation‑focused approach to device provisioning, configuration and lifecycle management.
• Good knowledge of hardware asset management, device support and secure decommissioning practices.
• The ability to work with support teams, security personnel and external vendors to resolve technical issues.

Skills and Knowledge

• Windows 11 administration and practical knowledge of macOS device management.
• Microsoft Intune for device enrolment, configuration, compliance and application deployment.
• Windows Autopilot, Apple Business Manager and zero‑touch device provisioning.
• Endpoint security controls, including Microsoft Defender for Endpoint, BitLocker, FileVault and Windows LAPS.
• Security baselines and endpoint‑hardening standards, including CIS‑aligned configuration.
• Application packaging, testing and deployment using modern endpoint‑management platforms.
• Operating‑system servicing, feature upgrades, security updates and third‑party patch management.
• Endpoint troubleshooting, hardware and software inventory, asset lifecycle management and secure device decommissioning.

Qualifications and Experience

• A relevant diploma or degree in Information Technology, Computer Science or a related field, or equivalent practical experience.
• Approximately 4–6 years’ experience managing and supporting enterprise endpoint environments.
• Hands‑on experience with Microsoft Intune, Windows Autopilot and modern Windows device management.
• Practical experience with device configuration, compliance policies, application deployment and operating‑system servicing.
• Experience implementing endpoint security controls such as Defender for Endpoint, BitLocker, FileVault or Windows LAPS.
• Exposure to macOS management, Apple Business Manager and mobile‑device management would be beneficial.
• Experience providing second‑line technical support and coordinating hardware, software and vendor escalations.
• Microsoft Endpoint Administrator Associate certification is required or strongly preferred; other endpoint‑management certifications would be beneficial.

Other Requirements

• Hybrid working model with regular in‑office presence in Stellenbosch, based on team rhythms, collaboration needs and business requirements.
• Ability to attend key planning sessions, stakeholder workshops and in‑person team collaboration when required.
• Reliable internet connectivity and a suitable remote‑working setup for work‑from‑home days.