Windows SME

Job Title: Windows & Linux Compliance SME

The MSFT Windows Compliance SME supports the Stay in Compliance Lead by managing compliance, risk and control activities across the global on-premises Windows Server estate. The role provides deep technical expertise for Microsoft Windows Server 2019, 2022 and 2025, Active Directory, Group Policy, Microsoft Configuration Manager, PowerShell Desired State Configuration, server hardware, virtualisation and associated hybrid-cloud management capabilities. The role helps maintain a secure, supported and consistently configured estate through vulnerability remediation, security hardening, patch and version currency, configuration baselines, identity and access controls, automation, hardware lifecycle management and audit assurance.

Working with On-Prem Hosting Engineering and Operations, Information Security, Active Directory, Service Management, hardware, virtualisation, cloud and application teams, the role assesses security findings and configuration drift, engineers and coordinates large-scale remediation, and produces traceable governance and audit reporting. The position provides Windows-specific subject-matter expertise and clear escalation to the Stay in Compliance Lead, while coordinating cross-platform dependencies where Windows services interact with Linux, Azure, AWS, VMware, Nutanix AHV or Hyper-V environments.

• Serve as the compliance SME for the global on-premises Microsoft Windows Server estate, supporting environments at enterprise scale, including estates exceeding 10,000 servers.
• Monitor Microsoft security advisories, vulnerability findings, operating-system alerts, configuration data and vendor notifications to identify exposure affecting Windows Server 2019, 2022 and 2025.
• Assess technical impact, affected versions, exploitability, business criticality, service dependencies and compensating controls, and support risk-based prioritisation in line with agreed standards and remediation SLAs.
• Engineer, package, test and coordinate large-scale remediation for security vulnerabilities, configuration changes and software updates using Microsoft Configuration Manager, PowerShell, Desired State Configuration and Ansible.
• Design, implement and maintain Group Policy Objects and verify consistent application across relevant Active Directory forests and domains.
• Create and maintain security configuration items, baselines, compliance rules and automated corrective controls using PowerShell DSC and approved enterprise tooling.
• Plan and schedule deployment waves for patches, security configurations, GPO changes, software packages, firmware and drivers, balancing remediation urgency with production stability.
• Maintain compliance visibility across physical and virtual Windows servers hosted on VMware ESXi, Nutanix AHV and Hyper-V, including hardware, firmware, drivers, operating-system versions and support lifecycle.
• Support secure account and access management for Windows servers, including privileged access, service accounts, local administrator controls, authentication policy and role separation.
• Perform security and performance analysis and recommend hardening, tuning and configuration changes for mission-critical production systems in data-centre environments.
• Support hybrid management of on-premises servers through Microsoft Azure capabilities, including Azure Arc-enabled servers, Azure Policy, machine configuration, monitoring and update-management concepts where adopted.
• Coordinate cross-platform remediation dependencies with Linux teams using Red Hat Satellite and Ansible Automation Platform when shared services, automation or controls span Windows and Linux environments.
• Prepare implementation plans, technical procedures, validation steps, rollback plans, change records and stakeholder communications for compliance deployments.
• Track remediation actions, ageing, exceptions, deployment failures, dependencies and closure evidence, escalating material risk or delivery delays to the Stay in Compliance Lead.
• Maintain accurate compliance records covering server inventory, patch and configuration status, GPO application, software and firmware currency, lifecycle, vulnerabilities, ownership, approved exceptions and evidence.
• Use ServiceNow, Microsoft Configuration Manager, Power BI, Dell OpenManage Enterprise, monitoring platforms, SharePoint, scripts and APIs to analyse compliance, automate recurring tasks and produce dashboards and reports.
• Support internal and external audits by providing timely, complete and traceable Windows Server configuration, access, patching, lifecycle and remediation evidence.
• Identify opportunities to standardise and automate vulnerability assessment, packaging, deployment, compliance validation, evidence collection and reporting using DevOps and infrastructure-as-code practices.
• Build effective working relationships across Engineering, Operations, Information Security, Service Management, Active Directory, Linux, cloud, virtualisation, hardware and application teams while operating within the governance direction set by the Stay in Compliance Lead.

• Advanced hands-on administration and compliance experience with Microsoft Windows Server 2019, 2022 and 2025 in large, globally distributed production environments.
• Expert knowledge of Active Directory, Group Policy design and management, domain and forest structures, authentication, service accounts and privileged-access controls.
• Proven experience assessing security risk, remediating Windows Server vulnerabilities, applying security baselines and tuning systems securely without compromising service availability.
• Deep scripting and automation capability in PowerShell, WMI and Python; experience with Ansible is required, while VBS and Perl knowledge is beneficial for legacy environments.
• Strong experience administering Microsoft Configuration Manager and packaging and deploying software, scripts, updates and remediation controls at enterprise scale.
• Experience creating configuration items, security baselines and desired-state controls using PowerShell DSC or equivalent configuration-as-code capabilities.
• Ability to interpret Microsoft security advisories, CVEs, severity scores, vulnerability scan findings, support lifecycle information and technical prerequisites and translate them into deployment actions.
• Strong knowledge of Windows Server hardware management, firmware and driver currency, remote management and lifecycle controls; Dell OpenManage Enterprise experience is advantageous.
• Good knowledge of VMware ESXi, Nutanix AHV and Hyper-V virtualisation and the operational dependencies between guest operating systems and hosting platforms.
• Working knowledge of Microsoft Azure and hybrid-cloud management, including Azure Arc-enabled servers, Azure Policy, machine configuration, monitoring and update-management concepts; AWS familiarity is beneficial.
• Working knowledge of Linux security and administration, Red Hat Satellite and Ansible Automation Platform sufficient to coordinate shared compliance and automation dependencies.
• Experience with ServiceNow, Power BI, SharePoint, monitoring and systems-management platforms for remediation tracking,