Engineer - Endpoint Experience

Description

You will join the Endpoint Experience team, which is being formed inside Workplace Experience in Digital Foundation.

The team manages the company's employee devices: laptops, workstations, phones and tablets. It covers how security policy reaches each device, how changes are tested before release, how apps are packaged and offered to staff, how the service is measured, and which devices are bought.

The company is bringing endpoint engineering in-house. The goal is to make patching, rolling out new tools such as AI tooling for every employee, and changing device platforms routine engineering work the team controls, instead of long projects.

You will help turn device management into a product with version control, automated tests, staged rollouts and clear metrics. You will also help assess major device vendors and management platforms as the estate evolves.

This is a hands-on role in a growing team, with senior engineers supporting your development. You will own real parts of the platform, including pipelines, automation, app packaging, device trials and metrics. Current platforms are Intune for Windows and Jamf for Apple.

You report to the Engineering Manager for Endpoint Experience and work closely with Cyber Security, Developer Productivity, IT Support, Finance and Procurement. The team does not provide first-line support: IT Support handles first response and device handover, Workplace Infrastructure runs on-premises servers, and Developer Infrastructure runs cloud servers.

The team exists to keep devices secure by default, reliable and pleasant to use. Each change should be versioned and reviewed, proven safe on a representative group before reaching everyone, and visible in metrics that show whether staff are better off.

Success looks like pipelines that run reliably with runbooks others can follow, a low change failure rate, dashboards colleagues trust, apps staff can self-serve, evaluations that guide purchasing, and growing ownership over your first year.

Responsibilities

• Build pipelines that turn device configuration and Cyber Security's policy into versioned code, deploy it through Intune and Jamf, and detect and report drift.
• Build and run automation that keeps patch compliance at the required level and reports it openly.
• Create and maintain endpoint security configurations and compliance baselines, applying the device controls Cyber Security defines in Intune and Jamf.
• Automate the device side of joiner, mover and leaver processes, from day-one setup to recovering and wiping a leaver's device.
• Build and run a test harness that checks policy, OS, app and configuration changes on representative device groups before fleet rollout, with staged rings, health checks and rollback. Keep those groups healthy and representative.
• Instrument device telemetry and build dashboards for service health, compliance, provisioning time, change failure rate, support demand and employee satisfaction.
• Take part in the regular employee feedback cycle, investigate incidents and change failures, fix root causes, and feed lessons back into the harness and pipelines.
• Package, test and publish apps to the self-service catalogue and to automated deployments. Patch them with security updates first, and retire software that is no longer needed or licensed.
• With Developer Productivity, package and maintain the developer toolset so a new engineer's machine is ready to build and ship on day one.
• Automate repetitive packaging and update work so staff can find and install what they need without raising a ticket.
• Run structured device evaluations with real users, collect performance, reliability and satisfaction data, and write up the results.
• Maintain device standards and employee personas so hardware, apps and configurations match business needs. Supply data on device age, failure rates and cost to inform lifecycle and refresh decisions.
• Work day to day with IT Support so changes are understood and supportable, and with Cyber Security engineers to turn requirements into tested device policy.
• Share what you learn across Digital Foundation through documentation and demos.

Requirements

• You likely bring the following.
• Solid experience managing modern devices, and a wish to move from operating tools to building the platform behind them.
• Curiosity about running a device fleet like a production system, enjoyment of automating manual work, and care for the people using the devices.
• Hands-on experience with Microsoft Intune or Jamf Pro, ideally both, managing Windows or macOS devices in an enterprise.
• Scripting in PowerShell, Python or shell, plus some version control and CI pipeline experience, or a strong wish to apply them to endpoint management.
• An understanding of how endpoint security controls, compliance requirements, identity and conditional access translate into device configuration.
• Experience packaging and deploying applications and OS updates, and handling what happens when they fail.
• Comfort with telemetry: building a dashboard, spotting a trend and explaining what it means.
• Fluency with AI-assisted ways of working, and an appetite to keep learning what they can do.
• Clear written communication, and the habit of asking why a process exists before automating it.

Conditions

Hybrid working: at least two days a week in the office to support collaboration, decisions and shared ownership.

Benefits

• Competitive salary, pension and private medical care.
• Performance-related bonus.
• Flex benefits allowance, which you can take as extra cash or put toward other benefits.
• 25 days paid annual leave plus an extra day for your birthday.
• Staff discount on the company's products.
• Tech Develops, the internal programme for technical skills and personal growth.
• Chance to represent the company at leading industry events.
• Chance to help shape diversity and inclusion work in tech, including the WIT movement and diversity mentoring in tech.
• Chance to make an impact from day one while working with cutting-edge technology.