Lead Mobility Engineering SME

Description

The company is rethinking how it helps customers manage risk, and this senior engineering role supports that change.

Technology sits at the center of underwriting and claims work. The Information Technology team gives colleagues tools to work efficiently and to a high standard, protects company systems from security threats, and sets technology strategy so each business unit can reach its goals. New ideas in IT spread into every other part of the company.

This is a senior, hands-on role in the Information Technology (IT) team, in the Cybersecurity InfoSec functional area.

The role is the senior hands-on engineer responsible for architecture, engineering, security, automation, and day-to-day health of the enterprise mobile and modern endpoint estate. That covers Microsoft 365 mobile services, Microsoft Intune, MDM and MAM, Apple iOS and iPadOS, Android Enterprise, and modern Windows provisioning with Autopilot.

This is not a coordination or console administration job. It spans mobility platform engineering, modern authentication, endpoint security and network connectivity, and automation, and you need strength in all four.

Responsibilities

• Set the architecture and configuration standards for Intune, enrollment, MAM and app protection, compliance, configuration profiles, app deployment, certificates, and secure access.
• Run the Apple stack end to end, including Apple Business Manager, Automated Device Enrollment, APNs certificate lifecycle, VPP, supervision, Declarative Device Management, and managed software updates.
• Manage Android Enterprise in fully managed, dedicated or kiosk, COPE, and work profile modes, including managed Google Play, zero-touch enrollment, OEMConfig, and Knox.
• Plan compatibility, ring-based rollout, and lifecycle so major OS releases are scheduled events rather than emergencies.
• Use working knowledge of Omnissa Workspace ONE UEM (formerly VMware Workspace ONE / AirWatch), MobileIron/Ivanti Neurons, Jamf, SOTI, or BlackBerry UEM to guide migration, coexistence, and platform choices, and convert legacy profiles, policies, and apps into Intune equivalents without losing control coverage.
• Build device authentication across Entra ID registration, Entra join and hybrid join, Primary Refresh Token behavior, device-based Conditional Access, and token and session controls.
• Deliver passwordless and phishing-resistant sign-in on mobile, using platform credentials, FIDO2 and passkeys, certificate-based authentication, and Authenticator broker behavior.
• Own certificate infrastructure, including SCEP and PKCS, the Intune Certificate Connector, Cloud PKI, NDES, trusted roots, and renewal automation.
• Design Conditional Access and test its impact in report-only mode before production. Debug OAuth 2.0, OIDC, SAML, and MSAL failures at protocol level.
• Own Windows Autopilot in user-driven and self-deploying modes, including pre-provisioning, Autopilot device preparation, Enrollment Status Page tuning, hardware hashes and attestation, and the OEM supply process.
• Operate settings catalog, security baselines, filters, scope tags, RBAC, Windows Update for Business, and Autopatch rings. Move workloads off legacy management through co-management and GPO migration. Own Win32 and MSIX packaging, detection logic, and supersedence chains.
• Build compliance, app protection, DLP, encryption, and certificate-based access with Cybersecurity, IAM, Privacy, and Legal.
• Feed Defender for Endpoint and mobile threat defense signals into compliance and Conditional Access. Apply ASR rules and jailbreak and root detection.
• Own key escrow, device wipe and departure processes, Endpoint Privilege Management, and LAPS. Keep secure baselines current, fix drift and unsupported OS versions to defined targets, and provide audit evidence from reporting rather than screenshots.
• Design and troubleshoot 802.1X and EAP-TLS Wi-Fi, RADIUS and NPS integration, roaming, and captive portal behavior.
• Design per-app and always-on VPN, Global Secure Access and ZTNA patterns, and split-tunneling decisions.
• Diagnose how DNS, proxies, and TLS inspection affect certificate pinning and push notifications, APNs and FCM egress, IPv6, and carrier and eSIM behavior. Turn captures and traces into configuration changes, not handoffs.
• Automate with PowerShell, Microsoft Graph, REST, and JSON for bulk policy deployment, lifecycle tasks, compliance and expiry reports, and drift detection against baseline.
• Apply source-controlled policy as code with peer review and promotion across rings. Close operational loops with Power Automate, Azure Automation or Functions, proactive remediations, and ITSM integration.
• Build proactive monitoring and alerts for enrollment failures, noncompliance, deployment errors, and service degradation.
• Own each change from scope and impact through test evidence, pilot, implementation, validation, communication, and tested backout.
• Lead Tier 3 and Tier 4 troubleshooting and root-cause analysis. Drive vendor escalations with complete diagnostic evidence.
• Maintain architecture diagrams, designs, runbooks, and decision records detailed enough for another qualified engineer to run and recover the service.
• Mentor engineers, set engineering quality standards, and keep a prioritized roadmap and technical debt backlog.

Requirements

• 7+ years in endpoint, mobility, or digital workplace engineering, with significant ownership of enterprise mobile services in a large or complex environment.
• Deep hands-on Intune experience across enrollment, compliance, configuration profiles, app deployment, app protection, reporting, and troubleshooting.
• Strong MDM and MAM architecture knowledge for corporate-owned and BYOD scenarios, plus iOS and iPadOS and Android Enterprise management models and OS lifecycles.
• Hands-on exposure to at least one more UEM platform, such as Workspace ONE UEM (AirWatch), Ivanti/MobileIron, Jamf, or SOTI, including migration or coexistence work.
• Modern Windows provisioning experience with Autopilot, ESP troubleshooting, and update ring strategy.
• Working knowledge of Entra ID, modern authentication, Conditional Access dependencies, and certificate-based secure access.
• Practical mobility network skills: 802.1X and certificate-based Wi-Fi, VPN and per-app VPN, and the effects of DNS, proxies, and TLS inspection.
• Proven automation with PowerShell, Graph, REST APIs, and JSON, plus root-cause troubleshooting using logs, telemetry, and structured testing.
• Experience with enterprise change, incident, and problem management, strong technical documentation, and clear communication with technical and nontechnical stakeholders.
• Preferred: Advanced end-to-end ownership of Microsoft Intune, covering design, engineering, and Tier 3 and Tier 4 support across tenant and RBAC architecture, enrollment, policy, app deployment, and certificate services, with equivalent hands-on design, engineering, and support experience on Omnissa Workspace ONE UEM (AirWatch).
• Preferred: Deep mobile platform specialization, including Apple Business Manager and Declarative Device Management at scale, Android Enterprise dedicated and kiosk fleets, mobile threat defense, and zero-touch provisioning.
• Preferred: Large-scale UEM migration into Intune from Omnissa Workspace ONE UEM (AirWatch) or Ivanti/MobileIron, including policy mapping, app repackaging, and phased device cutover.
• Preferred: Telecom, carrier, or eSIM integration, passwordless authentication on mobile, or legacy VPN retirement.
• Preferred: Experience in a global, highly regulated, or large-enterprise environment, including frontline and shared-device populations alongside corporate users.
• Preferred: Certifications such as MD-102, SC-300, SC-200, SC-100, Apple Certified IT Professional, Android Enterprise Professional, or CCNA.

Conditions

For positions based in New York, NY, the base salary range is $150,000 to $190,000, and the role is eligible for a bonus under the applicable incentive plan terms.

Actual pay depends on skills, experience, and qualifications. Candidates whose expectations are above the posted range are still encouraged to apply.

The company asks team members to be primarily in the office, to support in-person collaboration.

Equal opportunity is provided to all qualified individuals regardless of race, color, religion, age, gender, gender expression, national origin, veteran status, disability, or other legally protected categories.

Benefits

• Total Rewards Program covering health, wellbeing, financial security, and professional development, extending beyond work time.
• A US benefits overview is available that summarizes the competitive benefits offered.