Systems Engineer III - Endpoint Management

Sprouts Farmers Market•Phoenix, AZ

5d•Hybrid

About The Position

The Systems Engineer III – Endpoint Management is a hands-on engineering role responsible for the day-to-day management, configuration, and continuous improvement of Sprouts’ corporate and retail endpoint fleet across Windows and macOS. Working within a small, high-impact endpoint team, this engineer builds and maintains device configuration, application deployment, patching, and compliance across Microsoft Intune, Microsoft Configuration Manager (SCCM), Tanium, and Kandji. This is an execution-focused engineering role. Endpoint strategy and platform direction are set in partnership with the Systems Engineering Supervisor and senior engineers; this position contributes technical recommendations, owns the build and rollout, and serves as an escalation point for the service desk. The role reports to our Store Support Office in Phoenix, AZ, with a hybrid work arrangement requiring in-office presence Tuesday through Thursday.

Requirements

Bachelor’s degree in Computer Science, Information Technology, or equivalent professional experience.
3+ years in endpoint engineering, systems engineering, or device management roles within an enterprise environment.
Hands-on proficiency with Microsoft Intune, including configuration profiles, compliance policies, application deployment, and update rings.
Working experience with Microsoft Configuration Manager (SCCM/MECM) for software distribution, operating system deployment, or patch management.
Hands-on experience with Windows Autopilot enrollment, including hardware hash collection, deployment profiles, and Enrollment Status Page configuration.
Proficiency in PowerShell for endpoint automation, scripting, and reporting; ability to write and troubleshoot scripts independently.
Working knowledge of Microsoft Entra ID, Conditional Access, and device compliance concepts.
Experience planning and executing patching or operating system upgrade campaigns across a distributed device fleet.
Familiarity with endpoint security frameworks such as CIS Benchmarks and standard patch management practices.
Strong problem-solving and analytical skills, with the ability to clearly explain technical concepts to both technical and non-technical audiences.

Nice To Haves

Experience with Tanium for patching, software deployment, or compliance enforcement.
Experience managing macOS endpoints through Kandji, Jamf, or a comparable Apple MDM platform, including Apple Business Manager.
Experience supporting endpoints in a retail, distributed-site, or multi-time-zone environment.
Experience with third-party patching platforms such as Patch My PC.
Familiarity with ChromeOS device management and kiosk configuration.
Additional scripting experience with Bash, Python, or Microsoft Graph API.
Exposure to Microsoft 365, Windows Server, or VMware vSphere administration.
Relevant certifications such as Microsoft MD-102 (Endpoint Administrator Associate), AZ-104, or Apple/Kandji certifications.

Responsibilities

Build, deploy, and maintain device configuration profiles, compliance policies, and security baselines across Windows and macOS using Microsoft Intune and Kandji.
Administer Microsoft Configuration Manager (SCCM) for the existing store and corporate Windows support the ongoing migration of those devices to Intune and Windows Autopilot.
Manage zero-touch enrollment programs including Windows Autopilot and Apple Business Manager (ABM/DEP), including hardware hash management, enrollment status pages, and vendor drop-ship coordination.
Own operating system patching and feature update campaigns using Tanium and Intune update rings, including ring design, pilot validation, phased rollout across time zones, communication, and rollback planning.
Package, test, and deploy applications and application updates across Windows and macOS using Tanium, Intune, Patch My PC, and Kandji, favoring automated role-based assignment over manual installation.
Develop and maintain PowerShell automation for endpoint lifecycle tasks including remediation scripts, reporting, bulk operations, and Microsoft Graph API interactions.
Configure and maintain endpoint security controls including disk encryption, local administrator management, certificate deployment, and CIS benchmark enforcement in partnership with the Information Security team.
Support Conditional Access and device compliance policy configuration within Microsoft Entra ID, ensuring devices meet posture requirements before accessing corporate resources.
Diagnose and resolve escalated tier 3 endpoint incidents spanning hardware, operating system, application, and management-policy layers; perform root cause analysis and implement preventive fixes.
Create and maintain operational documentation including enrollment procedures, policy configurations, deployment runbooks, and knowledge base articles for the service desk.
Serve as a technical escalation point for the service desk and provide coaching and knowledge transfer to support staff and junior engineers.
Participate in a rotating on-call schedule providing first-line tier 3 support for server and infrastructure issues.
Support off-hours deployment windows as required for retail store maintenance across multiple time zones.
Evaluate new endpoint tooling and capabilities through proof-of-concept work and provide recommendations to the Systems Engineering Supervisor and senior engineers.

Benefits

Competitive pay
Sick time plan that you can use to support you or your immediate families health
Vacation accrual plan
Opportunities for career growth
15% discount for you and one other family member in your household on all purchases made at Sprouts
Flexible schedules
Employee Assistance Program (EAP)
401(K) Retirement savings plan with a generous company match
Company paid life insurance
Contests and appreciation events throughout the year full of prizes, food and fun!
Bonus based on company and/or individual performance
Affordable benefit coverage, including medical, dental and vision
Health Savings Account with company match
Pre-tax Flexible Spending Accounts for healthcare and dependent care
Company paid short-term disability coverage
Paid parental leave for both mothers and fathers
Paid holidays
DailyPay