Principal - EUC / MDM Platform Engineer

Overview

Build, automate and run the endpoint platform that manages Windows and macOS laptops and desktops, iOS and Android phones and tablets, and specialised devices across the GSK estate, as a hands-on platform engineer.

What you'll do

• Design, build, test and deploy endpoint configuration: Intune configuration and compliance policies, Autopilot and enrolment profiles, Windows Update rings, macOS configuration profiles, and iOS/Android enterprise policy.
• Build and maintain the provisioning experience, including zero-touch deployment, enrolment journeys and the out-of-box experience.
• Package, test and deploy applications at scale, including Win32 and MSIX packaging, macOS packages, mobile app assignment and configuration, and dependency and supersedence management.
• Implement to the reference architecture and standards set by the Principal Architect, and raise a design challenge when reality does not match the design.
• Deliver backlog items to production with tests, telemetry, documentation and a rollback path.
• Automate provisioning, enrolment, lifecycle, licence and asset reconciliation, reporting and proactive remediation, including detection and remediation scripts.
• Express endpoint configuration as code in version control and build and maintain CI/CD pipelines for policy and package deployment with staged ring-based rollout.
• Replace manual runbook steps with self-healing and self-service.
• Own operational health of assigned platforms, including enrolment success, policy assignment and compliance, patch and OS currency, application deployment success and device performance.
• Investigate and resolve complex incidents and problems as third-line escalation for endpoint issues, and drive root-cause elimination.
• Participate in an on-call rotation for major incidents affecting the device estate.
• Manage vendor change from Windows and macOS feature updates, iOS and Android major releases, MDM platform updates and hardware model introductions, testing in a lab before rollout.
• Maintain patch, OS currency and vulnerability remediation to target, and correct configuration drift.
• Implement and maintain endpoint security controls, including disk encryption and key escrow, EDR deployment and health, application control, local privilege management, security baselines and device compliance feeding Conditional Access.
• Remediate endpoint vulnerabilities in partnership with Cyber Security, at fleet scale and to SLA.
• Produce audit evidence such as configuration baselines, patch compliance and change records, generated automatically where possible.
• Build to regulated-environment requirements where applicable, including GxP-qualified endpoints and their validation and change control.
• Work daily with the Product Owner on refinement and estimation, and with the Architect on design.
• Produce operational documentation, runbooks and knowledge articles usable by the service desk and the next engineer.
• Support and coach service desk, deskside and field teams, and transfer capability to them.
• Mentor junior engineers and contribute to engineering standards and code review within the squad.

What you'll need

• Bachelor's degree in Computer Science, Engineering or a related discipline, or equivalent demonstrable professional experience.
• Overall 10+ years and 4+ years in IT engineering or endpoint operations.
• 3+ years working hands-on with an enterprise MDM/UEM platform (Intune, Jamf, Workspace ONE or equivalent) in production.
• Experience engineering or supporting an estate of 5,000+ devices.
• Hands-on capability in Windows endpoint management via Intune (or MECM) and at least one mobile platform (iOS or Android enterprise), including troubleshooting.
• Practical experience packaging and deploying applications at scale, including detection logic and failure diagnosis.
• Working PowerShell proficiency with real examples of automation delivered into production, and practical experience calling the Microsoft Graph API.
• Familiarity with Git and pull-request-based working; willingness to work configuration-as-code if not already doing so.
• Experience operating in an ITIL-aligned change and incident process, including ownership of production change against a live device fleet.
• Experience delivering within a Scrum or Kanban squad, including refinement, estimation and sprint commitment.
• Willingness to participate in an on-call rotation for major incidents.
• Fluent English, written and spoken.

Nice to have

• Relevant certifications such as Microsoft 365 Certified: Endpoint Administrator Associate or Expert, Jamf Certified Tech/Admin, Apple Certified Support Professional, Android Enterprise Professional, Azure Administrator, or ITIL v4 Foundation.
• Experience in a regulated industry, including GxP/CSV/CSA and validated-endpoint change control.
• Specialised and frontline devices, including rugged handhelds (Zebra, Honeywell), lab instrument workstations, clinical and field devices, kiosks, shared and multi-user workstations, scanners and shop-floor endpoints.
• Migration and transformation delivery, including SCCM to Intune, Windows 10 to 11 at scale, MDM platform change, or on-premises to cloud-native device management.
• Virtual desktop and cloud PC experience, including Azure Virtual Desktop, Windows 365, Citrix or VMware Horizon, and image and profile management.
• Endpoint security engineering, including Defender for Endpoint, WDAC/AppLocker, privilege management, endpoint DLP and threat hunting in device telemetry.
• Certificate and PKI operations as they touch devices, including SCEP, NDES and certificate lifecycle troubleshooting.
• Infrastructure-as-code tooling such as Bicep, ARM or Terraform for supporting Azure resources.
• Collaboration platform adjacency, including M365 workloads and how conditional access and app protection land on the device.
• Hardware and logistics exposure, including OEM engagement, imaging and staging partners, asset management and secure disposal.
• Accessibility and assistive technology provisioning and testing.

Details

• Location: Bengaluru, Luxor North Tower.