Lead End User Computing (EUC) Engineer (Ref 26558)

Responsibilities

Technical leadership & roadmap

• Own and maintain the technical roadmap for endpoint provisioning, OS lifecycle, encryption, and mobile management.

• Set engineering standards, baselines, and best practices; drive consistency across the estate.

• Mentor and provide technical direction to junior and mid-level engineers; review their work and grow their capability.

• Lead design reviews, evaluate new tooling/approaches, and make architecture recommendations to the EUC Manager.

Endpoint provisioning & imaging

• Design and continuously improve zero-touch device provisioning using Windows Autopilot (Entra hybrid and Entra-joined).

• Own Autopilot profiles, configurations, deployment profiles, and dynamic grouping.

• Maintain provisioning quality, driver/firmware management, OEM relationships, and resolution of complex enrolment failures.

OS lifecycle & upgrades

• Plan and lead Windows feature and EOL upgrade campaigns across the fleet.

• Own update rings, Windows Update for Business policies, and rollout strategy.

• Diagnose and develop repeatable remediation for upgrade failures (in-place upgrade blocks, hardening conflicts, disk/component issues).

Mobile device management

• Set strategy and standards for iOS and Android enrolment, configuration, and compliance via Intune (BYOD and corporate-owned).

• Own app protection / MAM policies, certificate and Wi-Fi/VPN profiles, and mobile app deployment.

Requirements

• 7+ years in endpoint engineering / EUC, with a track record of owning a Windows fleet end-to-end at scale.

• Demonstrated experience leading workstreams and mentoring or technically guiding other engineers.

• Expert-level Microsoft Intune/SCCM administration across Windows and mobile.

• Deep, hands-on Windows Autopilot experience in production at scale.

• Proven ownership of Windows OS upgrade / EOL migration programmes from planning through delivery.

• Strong command of BitLocker, Entra ID, Conditional Access, and Windows compliance.

• Tanium (or SCCM / ConfigMgr) for endpoint management and patching.

• Advanced PowerShell scripting; comfortable automating against the Microsoft Graph API.

• Certifications such as Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) or equivalent; Microsoft 365 Certified: Administrator Expert (MS-102), SC-300, or SC-200 a plus.

Licence no: 12C6060