Senior Endpoint Engineer

Dunhill Solutions • Washington, DC

4d • Hybrid

About The Position

The Senior Endpoint Engineer defines the target state for a federal agency’s device provisioning, management, security, and support, and leads the engineering work to achieve it. The central mission is to modernize a ConfigMgr-centric, on-premises environment into a cloud-native model built on Microsoft Intune, Entra ID, Windows Autopilot, and Windows Autopatch, aligned with federal Zero Trust requirements. The engineer owns the roadmap, design decisions, and reference standards while remaining hands-on with ConfigMgr, Intune, Dell enterprise tooling, and BeyondTrust. This is an individual-contributor role with no supervisory duties; leadership is exercised through technical direction. Work is tracked in ServiceNow and Azure DevOps (ADO) Boards.

The role defines and maintains endpoint target-state architecture and a multi-year modernization roadmap; produces architecture diagrams, design documents, architecture decision records, and reference configurations; evaluates capabilities through proofs of concept; and establishes user persona models and engineering standards. It leads planned transitions from ConfigMgr to Intune, hybrid join to Entra ID join, and legacy imaging and application approaches to zero-touch provisioning, modern update management, and Intune-based app delivery. It also coordinates cutovers and rollback plans, supports the reduction and eventual decommissioning of ConfigMgr infrastructure, and serves as a senior escalation point for endpoint issues.

The engineer designs endpoint security aligned with NIST SP 800-53, Microsoft security baselines, and applicable DISA STIG or CIS benchmarks; defines device compliance signals for Entra Conditional Access; builds automation using PowerShell and Microsoft Graph API; and develops queries, dashboards, and modernization metrics. The role authors and presents CAB requests, reviews engineering changes, plans work in ADO Boards linked to ServiceNow records, writes operational documentation, and mentors engineers through design reviews, pairing, and walkthroughs.

The position is hybrid in Washington, DC, with at least two days per week onsite. Compensation is $150,000–$175,000 per year. Candidates must be U.S. citizens with no dual citizenship and able to pass a federal background investigation for access to sensitive information.

Requirements

• Bachelor’s degree in Information Technology, Computer Science, or a related field, or 12+ years of relevant experience in lieu of a degree.
• 8+ years of enterprise Windows endpoint management experience, including 2+ years leading the design of significant endpoint initiatives.
• Hands-on experience with both ConfigMgr and Microsoft Intune, including co-management, and experience moving at least one workload or device population from ConfigMgr to Intune.
• Experience designing and deploying Windows Autopilot for production users in at least one deployment mode.
• PowerShell scripting for automation and ability to read and adapt scripts that use the Microsoft Graph API.
• Ability to write clear design documents, diagrams, and SOPs that other engineers can carry out.
• Experience with incidents, problems, and change requests in ServiceNow or a comparable ITSM tool.
• CompTIA Security+ certification held at start or earned within 90 days.
• Ability to work onsite in Washington, DC at least two days per week.
• U.S. citizenship with no dual citizenship and ability to pass a federal background investigation to be granted access to sensitive information.

Nice To Haves

• Experience with Windows Update for Business or Windows Autopatch, Intune Remediations, and Endpoint Analytics.
• Working knowledge of Entra ID, Conditional Access, and device compliance in a Zero Trust model.
• SQL and KQL experience querying ConfigMgr, Intune, and endpoint telemetry data.
• Endpoint experience in a federal environment under FISMA, NIST SP 800-53, and CISA directives, including Microsoft government cloud.
• Experience with Dell enterprise tooling such as Dell Command | Update, Dell Command | Configure, and BIOS and Secure Boot management.
• Experience with BeyondTrust or a comparable privileged access or remote support platform.
• Experience with Microsoft Defender for Endpoint, Windows LAPS, or Azure DevOps Boards.
• Certifications such as Microsoft MD-102, MS-102, SC-300, or ITIL 4 Foundation.

Responsibilities

• Define and maintain endpoint target-state architecture across identity, provisioning, configuration, application delivery, update management, security, and support tooling.
• Own the multi-year endpoint modernization roadmap, including phases, dependencies, entry and exit criteria, and risks.
• Produce current- and target-state diagrams, design documents, architecture decision records, and reference configurations.
• Evaluate Microsoft and vendor capabilities, conduct proofs of concept, and recommend adoption, deferral, or retirement based on cost, risk, and effort.
• Define user personas and endpoint engineering standards for naming, policy design, assignment and filtering, app packaging, and baseline management.
• Advise program leadership on endpoint risk, technical debt, licensing, and investment priorities.
• Lead the transition from ConfigMgr to Intune, moving co-management workloads in planned waves with pilot groups and defined success criteria.
• Drive the move from hybrid join toward Entra ID join and zero-touch provisioning with Windows Autopilot.
• Modernize update management with Windows Update for Business and Windows Autopatch, including update rings and driver and firmware policies.
• Move application delivery to Intune Win32 apps and catalog-based app management, and retire legacy packages.
• Replace approved on-premises dependencies with cloud services, such as Windows LAPS, cloud-based certificate delivery, and Intune Remediations.
• Plan the reduction and eventual decommissioning of ConfigMgr infrastructure.
• Coordinate cutovers with imaging, identity, network, security, and service desk teams, with tested rollback plans for each wave.
• Serve as the senior escalation point for ConfigMgr, Intune, co-management, Autopilot, and Windows 11 client issues.
• Design endpoint security configuration to meet NIST SP 800-53 controls, Microsoft security baselines, and applicable DISA STIG or CIS benchmarks.
• Define device compliance signals for Entra Conditional Access in partnership with identity and security teams.
• Build PowerShell and Microsoft Graph API automation for provisioning, configuration, compliance checks, and reporting.
• Develop KQL and SQL queries and dashboards using SSRS, Power BI, or Intune and Endpoint Analytics reports, and report modernization metrics.
• Author and present CAB requests for architecture-level and high-risk changes, and review other engineers’ changes.
• Plan roadmap work in ADO Boards linked to ServiceNow records; write SOPs, runbooks, and knowledge articles.
• Mentor engineers through design reviews, pairing, and walkthroughs.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior