Senior Systems Administrator, Endpoint Management & Patching

Virginia Farm Bureau Mutual Insurance•Henrico, VA

3d•$125,000 - $140,000•Hybrid

About The Position

The Senior Systems Administrator, Endpoint Management & Patching administers, maintains, and improves the organization’s Microsoft endpoint-management and software-deployment platforms. Microsoft Intune manages Windows workstations and mobile devices, while Microsoft Configuration Manager supports Windows Server patching, application deployment, imaging, inventory, and related systems-management functions. This hands-on engineering and operations role requires production experience with Configuration Manager, Intune, PowerShell, application packaging, software updates, and enterprise troubleshooting. The position also contributes to modernization efforts, including increased use of Intune, Windows Autopilot, Microsoft Entra ID joined devices, automation, and cloud-based management practices. The role is based at the West Creek office in Richmond, Virginia, with a hybrid schedule available after the in-office training period.

Requirements

Bachelor’s degree in information technology, computer science, information systems, or a related discipline, or an equivalent combination of education and relevant professional experience.
Hands-on experience administering Microsoft Configuration Manager in a production enterprise environment.
Experience administering Microsoft Intune for Windows device management, policies, applications, updates, and reporting.
Experience managing Windows Server software updates, including deployment groups, maintenance windows, exceptions, and troubleshooting.
Demonstrated application-packaging experience using MSI and EXE installers, silent installation parameters, detection methods, and PowerShell.
Experience with PowerShell App Deployment Toolkit or a comparable enterprise application-packaging framework.
Experience creating and maintaining Configuration Manager collections, queries, task sequences, Automatic Deployment Rules, and Software Update Groups.
Working knowledge of Active Directory, Group Policy, Microsoft Entra ID, PKI certificates, role-based access, and enterprise credential-management practices.
Ability to analyze logs, troubleshoot complex deployment or client-health problems, identify root causes, and coordinate resolution across technical teams.
Strong documentation and communication skills, including the ability to turn technical processes into usable operational guidance.
Several years of progressively responsible experience supporting enterprise endpoint management, systems management, application deployment, or patching platforms is preferred.

Nice To Haves

Experience administering Patch My PC with Microsoft Configuration Manager and Intune.
Experience with Windows Autopilot and Microsoft Entra ID joined device deployments.
Experience supporting Apple Business Manager integrations and mobile-device management through Intune.
Experience with Configuration Manager Cloud Management Gateway, HTTPS/PKI configuration, or clients in segmented and DMZ environments.
Experience with operating-system deployment, driver automation, SQL Server support for Configuration Manager, or vulnerability-remediation programs.
Familiarity with Azure Arc, Azure Update Manager, or other hybrid server-management technologies.
Microsoft 365 Certified: Endpoint Administrator Associate (MD-102), or other relevant Microsoft endpoint management certifications.

Responsibilities

Administer and troubleshoot Microsoft Configuration Manager, including site and component health, clients, collections, queries, deployments, task sequences, software updates, maintenance windows, and Cloud Management Gateway services.
Administer Microsoft Intune configuration profiles, compliance policies, application assignments, platform scripts, proactive remediations, device groups, assignment filters, update rings, and driver-management policies.
Manage Windows Server patching and oversee workstation patching through Intune update rings, reporting, exception handling, and follow-up on unsuccessful or incomplete installations.
Develop procedures and train the Desktop Support team to perform routine workstation patch administration, compliance monitoring, and first-level troubleshooting; provide engineering support for complex issues and platform changes.
Package, test, deploy, and maintain applications for Configuration Manager and Intune using MSI and EXE installers, PowerShell, and the PowerShell App Deployment Toolkit; develop detection methods, installation logic, dependencies, and rollback processes.
Administer Patch My PC integrations with Configuration Manager and Intune, monitor synchronization and publishing activity, and troubleshoot third-party application update failures.
Maintain operating-system deployment task sequences, Windows installation media, driver packages, hardware-model collections, and related imaging processes while supporting transition toward Windows Autopilot.
Troubleshoot Configuration Manager client health, software-deployment failures, update-compliance issues, task-sequence problems, and device-management exceptions across internal, remote, and segmented environments.
Support vulnerability remediation by translating security findings into tested application, configuration, or patch deployments and validating remediation outcomes.
Maintain integrations with Apple Business Manager and support certificate, token, device-compliance, configuration, and application-management requirements for supported mobile platforms.
Coordinate lifecycle management for platform certificates, application secrets, service accounts, shared credentials, and administrative access in accordance with security and operational requirements.
Create and maintain runbooks, troubleshooting procedures, escalation paths, and recurring operational checklists.
Identify opportunities to automate manual processes, improve monitoring and reporting, reduce deployment failures, and modernize endpoint provisioning and management.