Principal - EUC / MDM Platform Engineer

Responsibilities

• Design, build, test and deploy endpoint configuration across the estate: Intune configuration and compliance policies, Autopilot and enrolment profiles, Windows Update rings, macOS configuration profiles, and iOS/Android enterprise policy.
• Build and maintain the provisioning experience - zero-touch deployment, enrolment journeys, and the out-of-box experience that determines whether a new starter is productive on day one or raising a ticket.
• Package, test and deploy applications at scale - Win32 and MSIX packaging, macOS packages, mobile app assignment and configuration, dependency and supersedence management.
• Implement to the reference architecture and standards set by the Principal Architect; raise a design challenge when reality does not match the design rather than quietly deviating.
• Deliver backlog items to production with the tests, telemetry, documentation and rollback path included - "done" means running and observable across the fleet, not merely configured for one pilot device.
• Automate everything that would otherwise be done twice: provisioning, enrolment, lifecycle, licence and asset reconciliation, reporting, and proactive remediation.
• Build detection and remediation scripts that fix problems on the device before the user notices, and instrument them so you know whether they worked.
• Express endpoint configuration as code in version control; build and maintain CI/CD pipelines for policy and package deployment with automated validation and staged ring-based rollout.
• Replace manual runbook steps with self-healing and self-service; treat a recurring manual task as a defect with a backlog item attached.
• Own operational health of assigned platforms: enrolment success rates, policy assignment and compliance reporting, patch and OS currency, application deployment success, and device performance.
• Investigate and resolve complex incidents and problems - third-line escalation for endpoint issues - and drive permanent root-cause elimination.
• Participate in an on-call rotation for major incidents affecting the device estate.
• Manage the continuous change stream from vendors: Windows and macOS feature updates, annual iOS and Android major releases, MDM platform updates and hardware model introductions. Test in a lab, assess compatibility, and roll out under control.
• Maintain patch, OS currency and vulnerability remediation to target; hunt and correct configuration drift.
• Implement and maintain endpoint security controls: disk encryption and key escrow, EDR deployment and health, application control, local privilege management, security baselines, and device compliance feeding Conditional Access.
• Remediate endpoint vulnerabilities in partnership with Cyber Security, at fleet scale and to SLA.
• Produce the evidence audits require - configuration baselines, patch compliance, change records - generated automatically wherever possible.
• Build to regulated-environment requirements where applicable, including GxP-qualified endpoints and the validation and change control they demand.
• Work daily with the Product Owner on refinement and estimation, and with the Architect on design; give honest estimates and flag risk early.
• Produce operational documentation, runbooks and knowledge articles good enough that the service desk can use them and the next engineer can pick the work up.
• Support and coach the service desk, deskside and field teams; reduce escalation volume by transferring capability, not by absorbing it.
• Mentor junior engineers and contribute to engineering standards and code review within the squad.

Professional Qualifications

• Bachelors degree in Computer Science, Engineering or a related discipline, or equivalent demonstrable professional experience. Strong practical experience is an acceptable substitute for formal qualification.
• Relevant certifications desirable (e.g., Microsoft 365 Certified: Endpoint Administrator Associate or Expert, Jamf Certified Tech/Admin, Apple Certified Support Professional, Android Enterprise Professional, Azure Administrator, ITIL v4 Foundation).

Area of Specialisation

• Hands-on endpoint platform engineering - Microsoft Intune / Endpoint Manager, Autopilot, Windows Update for Business, Endpoint Analytics - at 50,000-device scale.
• Mobile device management engineering across iOS (Apple Business Manager, ADE/DEP, APNs, supervised devices) and Android Enterprise (work profile, fully managed, dedicated/kiosk, Managed Google Play), plus app protection and containerisation for BYOD.
• Complex endpoint troubleshooting across hardware, OS, identity, network and application layers.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.