Windows Endpoint Engineer

Overview Client•Pittsburgh, PA

11h•Onsite

About The Position

Client is seeking a Windows Client Engineer to manage and modernize its Windows endpoint environment through Microsoft Intune and SCCM (Configuration Manager), with a primary focus on reducing vulnerability risk. This hands-on role partners closely with security teams to analyze vulnerability findings, develop remediation solutions, and deploy fixes across the enterprise. The ideal candidate will have strong experience with Windows endpoint administration, endpoint vulnerability remediation, PowerShell scripting, and enterprise device management technologies. Success in this role requires the ability to investigate vulnerabilities, implement scalable fixes, and ensure compliance without disrupting end users.

Requirements

Bachelor's degree or higher.
3 to 5 years of experience engineering and administering Windows endpoints in an enterprise environment.
Proficiency with Microsoft Windows Client and Server operating systems.
Hands-on experience with Microsoft Intune and SCCM/Configuration Manager, including application packaging and deployment.
Strong PowerShell scripting skills for automation, detection, and remediation.
Experience with Windows patch management using Windows Update for Business, WSUS, or SCCM software updates.
Experience performing endpoint and vulnerability remediation, including investigating findings and implementing corrective actions.
Familiarity with vulnerability management concepts and tools, with Tenable experience strongly preferred and comparable platforms such as Qualys or Rapid7 considered relevant.
Understanding of CVEs, CVSS scoring, and translating vulnerability findings into remediation activities.
Knowledge of Windows operating systems, Active Directory, Group Policy, and Entra ID (Azure AD).
Ability to carefully test, validate, and deploy changes while minimizing impact to end users.
Demonstrated ability to work independently and proactively drive vulnerability investigation and remediation efforts.

Nice To Haves

Experience with application packaging tools such as PSADT, PatchMyPC, MSI, or MSIX.
Exposure to Microsoft Defender for Endpoint and Threat & Vulnerability Management integration.
Knowledge of security hardening frameworks, including CIS Benchmarks and DISA STIGs.
Relevant certifications such as Microsoft MD-102, SC-200, or CompTIA Security+.

Responsibilities

Review vulnerabilities identified through Tenable tools and manage the endpoint remediation process from investigation through closure.
Build, test, package, and deploy remediation solutions using Microsoft Intune and SCCM, including patches, application updates, configuration changes, registry modifications, and scripted fixes.
Author and maintain PowerShell scripts for automation, detection, and remediation, including Intune proactive remediations and SCCM configuration items.
Package and deploy third-party application updates through Intune, SCCM, or patch management tools.
Manage Windows Update policies and patching processes using Windows Update for Business, WSUS, or SCCM software updates.
Partner with vulnerability management and security teams to triage findings, validate remediation effectiveness, and identify false positives.
Track remediation progress and provide reporting on compliance, patch coverage, and outstanding risks against established service levels.
Maintain Windows configuration baselines and security hardening standards across endpoint devices.
Support co-management, device onboarding, compliance policies, and conditional access initiatives within the endpoint management environment.
Document remediation procedures and contribute to standardized, well-tested deployment practices.