Endpoint Management Architect – SCCM / Intune

The End-Point Lead/Architect owns the strategy, architecture, and team leadership for endpoint management across the Mosaic Infrastructure Managed Services engagement, supporting roughly 11,000+ endpoints across the United States, Canada, Brazil, Peru, and Paraguay. This role combines deep technical expertise in Microsoft SCCM (Configuration Manager/MECM) and Microsoft Intune with people leadership of the End-Point Engineer Sr./Jr. team, and is a key driver of the account's ongoing migration from traditional, on-premises endpoint management toward modern, cloud-first management.

• Own the end-to-end architecture and roadmap for endpoint management across SCCM (Configuration Manager/MECM) and Microsoft Intune, including the co-management strategy between the two platforms.

• Lead the Endpoint Engineer Sr./Jr. team, assigning work, setting technical direction, and reviewing complex endpoint engineering deliverables.

• Design and govern device configuration profiles, compliance policies, and security baselines in Intune, aligned to client security requirements.

• Drive the migration of managed endpoints from traditional SCCM-based management to modern, cloud-first Intune management, including Windows Autopilot deployment strategy.

• Own OS deployment (OSD), imaging, application packaging, and patch management standards across the managed endpoint estate.

• Serve as the primary escalation point and subject matter expert for complex endpoint issues that exceed Tier 2/3 support.

• Partner with the Security and NOC teams to ensure endpoint compliance policies, patching cadence, and vulnerability remediation are met.

• Coordinate mobile device management (MDM) and mobile application management (MAM) policy design, in line with the client's defined mobile device scope and exclusions.

• Maintain accurate documentation of the endpoint architecture, standards, and configuration baselines.

• Support hardware refresh and large-scale endpoint transition/migration programs, including planning and execution oversight.

• Mentor and develop Endpoint Engineer Sr./Jr. staff on SCCM/Intune administration and modern endpoint management practices.

• Report on endpoint compliance, deployment health, and project status to the Infrastructure Manager and client stakeholders.

What You’ll Bring

• 5+ years of experience in Endpoint Management, End-User Computing, or Endpoint Engineering, including 2+ years in a Lead or Architect role.

• Strong hands-on experience with Microsoft SCCM / Configuration Manager (MECM), including OS deployment, application packaging, software distribution, and patch management.

• Strong expertise in Microsoft Intune, including configuration profiles, compliance policies, security baselines, and Windows Autopilot.

• Experience with SCCM and Intune co-management, including strategies to modernize and transition endpoint environments.

• Working knowledge of Microsoft Entra ID (Azure AD), including hybrid join and Conditional Access concepts.

• Experience designing and implementing enterprise endpoint solutions and contributing to technology strategy and roadmaps.

• Experience leading, mentoring, or providing technical direction to engineering teams.

• Strong verbal and written communication skills in English, with the ability to work effectively with technical and business stakeholders.

Nice to Have

• Microsoft certification in Endpoint Management, such as Microsoft 365 Certified: Endpoint Administrator Associate.

• Experience supporting large, multi-country enterprise environments.

• Experience with macOS, iOS, or Android device management.

• Experience working in a managed services or outsourced IT environment.

• Bilingual English/Spanish or English/Portuguese.

• ITIL Foundation certification.

• Experience with PowerShell and endpoint automation.

Technical Skills & Tools

• Microsoft SCCM / Configuration Manager (MECM)

• Microsoft Intune

• Windows Autopilot and OS Deployment (OSD)

• Application Packaging and Software Deployment

• Microsoft Entra ID, Conditional Access, and Hybrid Join

• Endpoint Security Baselines and Compliance Policies

• Windows Patch Management, WSUS, and Intune Update Rings

• PowerShell and Endpoint Automation

• ServiceNow or equivalent ITSM platforms