Endpoint Engineer - AI Desktop Deployment (R-00193)

Job Responsibilities

• Perform enterprise desktop engineering for Windows 10 and Windows 11, including operating system configuration, deployment, lifecycle management, and troubleshooting.
• Administer and engineer Microsoft Intune / Microsoft Endpoint Manager environments for device enrollment, configuration, application deployment, compliance, and endpoint security.
• Design, implement, maintain, and troubleshoot Group Policy Objects (GPOs) supporting enterprise security, configuration, and operational requirements.
• Establish and maintain standardized Windows endpoint configurations, deployment methodologies, and engineering documentation.
• Develop and maintain Windows provisioning and deployment solutions, including Autopilot and automated device enrollment where applicable.
• Evaluate Windows updates, feature releases, drivers, firmware, and endpoint configuration changes before production deployment.
• Support endpoint modernization efforts and migration from legacy endpoint-management technologies to cloud-managed or hybrid-management architectures.
• Automate repetitive endpoint administration and configuration tasks using PowerShell and other approved scripting technologies.

Job Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related technical discipline.
• Experience deploying Microsoft Copilot, AI assistants, or other enterprise AI desktop applications.
• Familiarity with enterprise AI governance, data-loss prevention, information protection, and access-control considerations for generative AI tools.
• Experience evaluating endpoint hardware and software readiness for AI-enabled workloads.
• Familiarity with Windows AI capabilities, AI-enabled productivity platforms, or locally executed AI workloads.
• Experience integrating endpoint-management telemetry with security, identity, IT operations, or SIEM platforms.
• Experience with Windows Autopilot, Microsoft Graph, PowerShell automation, or proactive remediation technologies.

Government Cloud & Zero Trust Responsibilities

• Implement and maintain device compliance and Conditional Access controls supporting the Zero Trust device pillar.
• Engineer, deploy, and maintain STIG-compliant endpoint security baselines for Windows systems.
• Apply and maintain DISA STIG, organizational security baseline, and applicable federal endpoint-hardening requirements.
• Configure Intune compliance policies, configuration profiles, endpoint security policies, and security baselines for government environments.
• Support endpoint-management capabilities within applicable Microsoft Government Cloud environments, including GCC, GCC High, or related environments as required.
• Integrate endpoint posture and device-compliance signals with identity and access-control solutions.
• Ensure only authorized, managed, compliant, and appropriately secured devices can access protected enterprise resources.
• Implement endpoint controls supporting Zero Trust principles including device identity, continuous verification, least privilege, and risk-based access.
• Coordinate with identity teams on Microsoft Entra ID device registration, join models, Conditional Access, and authentication requirements.
• Support Microsoft Defender for Endpoint or equivalent endpoint detection, security telemetry, vulnerability-management, and response capabilities.
• Remediate endpoint vulnerabilities, configuration findings, compliance exceptions, and security control deficiencies.
• Assist with evidence collection and technical documentation supporting security assessments, audits, authorization activities, and continuous monitoring.
• Support endpoint configurations aligned with applicable NIST, FISMA, FedRAMP, CISA, DoD, or agency-specific security requirements, as applicable to the environment.
 
Preferred Certifications:
• Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) — strongly desired.
• AWS Certified Cloud Practitioner — desired only if the position supports or integrates with AWS environments.