Senior Engineer - Endpoint Experience

Description

This is a senior, hands-on engineering role on a new Endpoint Experience team being formed within Workplace Experience, which sits in Digital Foundation. The team manages employee devices, including laptops, workstations, phones and tablets. It covers security policy delivery, testing changes before release, packaging and offering applications, measuring service quality, and choosing which devices to buy.

The company is building endpoint engineering in-house. The goal is to make work such as raising patch compliance, rolling out new tools (for example AI tooling for every employee) and upgrading device platforms routine, controlled engineering rather than long projects. You will help create device management that works like a product, with version control, automated tests, staged rollouts and clear metrics. You will also keep assessing the main device vendors and management platforms to guide how the estate changes.

You will be one of the first engineers on the team and will set the technical standard for those who join later. You will write much of the code yourself and be the technical contact for Cyber Security, IT Support and Procurement. You will own the technical direction for Intune (Windows) and Jamf (Apple) management, security baselines and endpoint automation.

You will report to the Engineering Manager for Endpoint Experience and work closely with Cyber Security, Developer Productivity, IT Support, Finance and Procurement. The team does not provide first-line support. IT Support handles first response and device handover, while Workplace Infrastructure (on-premises) and Developer Infrastructure (cloud) own the servers.

The role exists to make the device estate secure by default, reliably run and pleasant to use. Much of what happens to a device between purchase and retirement is still manual, slow to change and hard to monitor. The team will make it engineered, so that every change is versioned and reviewed, tested on a representative group before wider release, and tracked through metrics that show whether employees are better served.

Responsibilities

• Set the engineering standards and technical approach for the team, help the Engineering Manager shape the roadmap, and document clear trade-offs between security, employee experience, cost and simplicity.
• Mentor engineers, review their work and set the expectations for using AI assistance in the team.
• Build a pipeline that treats device configuration and the security policy written by Cyber Security as versioned code, validates it and deploys it through Intune and Jamf. Every change should trace back to a reviewed source, and configuration drift should be detected.
• Make endpoint security baselines and patch compliance an automated standard that is continuously tuned, not a one-off project.
• Automate joiner, mover and leaver processes for devices, from a compliant device on the first day through to recovery and wipe with no manual steps.
• Build a test harness that checks policy, OS, application and configuration changes on representative device groups before fleet-wide release. Include staged rings, health gates and automatic rollback, so that it becomes the only route to production for device changes.
• Define and publish the metrics for service health and employee experience, including satisfaction, device health, compliance, time to provision, change failure rate and support demand. Combine them with regular employee feedback and turn the results into a prioritised improvement backlog.
• Set the endpoint analytics strategy, choosing the measures, telemetry and health indicators used to judge compliance, employee experience and platform effectiveness.
• Own the self-service application catalogue, packaging standards, release process and the full lifecycle of applications across devices. Every application should follow the same tested path as policy and stay current.
• Work with Developer Productivity to define and maintain the curated developer toolset (IDEs, runtimes, CLIs, AI coding tools and security tools), so new engineers can be productive on day one.
• Work with Cyber Security on allow-listing and with FinOps and Procurement on licence entitlement, while keeping packaging and deployment within the team.
• Own device standards for each employee persona. Run structured evaluations of hardware, vendors and management platforms covering fitness for purpose and total cost of ownership, and give Procurement and Finance recommendations backed by evidence.
• Define the lifecycle and refresh approach for the estate, balancing cost, sustainability, security and employee experience.
• Map applications, configurations and device capabilities to employee personas, so that provisioning stays secure, supportable and automated.

Requirements

• You have run a modern device estate at scale and find it frustrating how much of that work is still manual. You treat a fleet of devices as a distributed system that needs the same version control, testing and observability as any production service.
• You use AI assistants as a normal part of your engineering, wherever they help you reach a goal faster or better, and you keep your own judgement about what ships.
• Your background probably includes deep hands-on experience with Microsoft Intune and Jamf Pro, managing Windows and macOS at scale, including their APIs (Microsoft Graph and the Jamf API).
• You have treated device configuration as code, using version control, code review and CI pipelines, or you have a strong platform engineering background that you want to apply to this area.
• You are strong at scripting and automation in PowerShell, Python or shell.
• You have packaged and deployed applications at scale, run a self-service catalogue, and designed staged rollout and rollback strategies for changes that affect many users.
• You understand endpoint security controls, compliance frameworks, identity and conditional access, and how they become device policy.
• You are fluent with AI-assisted working and can tell when it helps and when it does not.
• You can explain trade-offs to security, finance and procurement stakeholders and disagree constructively.

Conditions

Hybrid working: you spend at least two days a week in the office to support collaboration, decisions and shared ownership.

The company is Disability Confident Committed. If you need reasonable adjustments during recruitment, tell the Talent team.

Benefits

• Employee discount on the company products and access to employee sample sales.
• 25 days of paid annual leave plus an extra day to celebrate a special moment.
• Discretionary bonus scheme.
• Private medical care scheme.
• A flexible benefits allowance that you can take as extra cash or spend on other benefits.
• Personalised learning and in-the-moment experiences to help you thrive in your role.