Intune Engineer
About The Position
The Intune Engineer is a hands-on, mid-level engineering role supporting the Endpoint Engineering Lead in modernizing the enterprise’s Microsoft Intune endpoint management platform. Following the Lead’s direction and established standards, the engineer builds, tests, and implements policy, provisioning, and application-delivery changes as the organization transitions from an Active Directory–anchored, co-managed environment to a cloud-native, Intune-first environment. The position works closely with the Lead and teams in Cybersecurity, Infrastructure, Identity, and Service Operations, with increasing ownership of these workstreams over time. This is a hybrid position requiring two days per week on-site at FERC headquarters. The role involves endpoint migration and engineering, policy and security configuration, application packaging and updates, automation, technical monitoring, documentation, and escalation support. Candidates must be able to meet Federal suitability requirements.
Requirements
- Bachelor's degree in Information Technology, Computer Science, another relevant field, or equivalent relevant experience.
- 3–5 years of enterprise endpoint management experience, including at least 2 years of hands-on Microsoft Intune work beyond day-to-day console administration.
- Familiarity with Hybrid Entra ID join and cloud-native Entra join and an understanding of their practical differences.
- Working knowledge of Active Directory Group Policy sufficient to review an existing GPO estate and understand its settings.
- Experience building Intune policies using the settings catalog and ADMX-backed profiles.
- Windows Autopilot experience, including profile configuration, Enrollment Status Page settings, and troubleshooting common provisioning failures.
- Application packaging experience, including building Intune Win32 packages with detection and requirement rules.
- Experience deploying quality and feature updates and familiarity with Microsoft 365 Apps update channels.
- Entra ID knowledge, including dynamic and assigned groups, Conditional Access, and device identity.
- Working PowerShell scripting ability for packaging, detection, and remediation tasks.
- Familiarity with security hardening frameworks such as NIST, CIS, or STIG.
- Ability to work a hybrid schedule with two days per week on-site and meet Federal suitability requirements.
Nice To Haves
- Federal, DoD, or similarly regulated environment experience, including GCC High tenants.
- Hands-on experience with a Hybrid-to-cloud-native join migration or converting an SCCM application catalog to Intune.
- Experience delivering certificates through SCEP or PKCS profiles and supporting PIV smart card authentication on managed endpoints.
- Experience with Windows LAPS in Entra ID, Windows Hello for Business cloud Kerberos trust, and Universal Print.
- Experience with Group Policy analytics and Intune MDM migration analysis tooling.
- Federal PKI experience, including derived PIV credentials, NDES/Certificate Connector, or Microsoft Cloud PKI.
- Experience with Intune Suite capabilities and Defender for Endpoint.
- Experience with third-party endpoint management tools such as Recast Software (Right Click Tools, Application Manager), PSAppDeployToolkit, Patch My PC, or similar.
- SCCM/MECM application catalog conversion experience.
Responsibilities
- Assist with migration from Hybrid Entra ID join to Entra-native join, including pilot testing, device object cleanup, cutover steps, and identifying blocking on-premises dependencies.
- Review Active Directory Group Policy settings, translate them into Intune settings catalog and ADMX-backed policies, test for conflicts and MDM-versus-GPO precedence issues, and document retired GPOs.
- Help identify and rework domain-dependent services for cloud-native endpoints, including logon scripts, mapped drives, print, local administrator passwords, and Kerberos-dependent applications and file shares.
- Configure and tune Windows Autopilot profiles and Enrollment Status Page settings; convert SCCM applications into Intune Win32, winget, and Enterprise App Catalog deployments with detection rules, dependencies, and supersedence.
- Deploy Windows quality and feature updates and Microsoft 365 Apps updates, including update ring design, channel assignment, deferrals, deadlines, expedited releases, and rollback.
- Build configuration, compliance, and certificate profiles, including SCEP/PKCS, PIV smart card, 802.1X, and VPN profiles.
- Apply NIST, CIS, and STIG hardening baselines; support Conditional Access, CDM reporting, and patch compliance against CISA Binding Operational Directive 26-04.
- Author PowerShell scripts for packaging, detection, remediation, and reporting; use Microsoft Graph API for bulk operations and drift detection.
- Follow Intune releases and Message Center posts, test changes in a pilot ring, and flag impacts to the Lead.
- Maintain runbooks and configuration documentation, and provide escalation support for complex endpoint issues.
- Work with the Endpoint Engineering Lead and Cybersecurity, Infrastructure, Identity, and Service Operations teams.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
