Job Summary

Intune Modern Management Engineer (L3)

Key Responsibilities

Intune Platform Engineering Design, administer, and optimize Microsoft Intune for enterprise Windows endpoint management. Define modern device management standards, governance controls, naming conventions, policy structures, and operational procedures. Manage Intune device lifecycle activities including enrollment, provisioning, configuration, compliance, monitoring, and retirement. Act as L3 escalation owner for complex Intune platform and device management issues. Maintain documentation for Intune architecture, policies, deployment standards, and support procedures. Device Product-Line & Persona Governance Own the differentiated configuration profile sets, security baselines, and app sets for each managed device Product Line: Modern Office Device (global reference baseline), SW Developer Device (Engineering PO, adjusted network/admin-rights posture), Privileged Access Workstation / PAW (hardened AVD clean image, reduced app set, App-Locker policy, privileged-role-only access), DevBoxes (Developer Platform team), and GEW Basic (Engineering AVD, ITT/XE PO). Coordinate all Product-Line-specific policy and configuration changes with the respective Product Owner and route final approval through Alice\'s RBAC model where role/scope changes are involved. Evaluate and onboard new Product Lines as they emerge, defining the required configuration and governance model. Windows Autopilot & Zero-Touch Provisioning Design and manage Windows Autopilot deployment models; support user-driven and pre-provisioned deployment scenarios. Troubleshoot device registration, enrollment, ESP failures, application installation failures, and policy assignment issues. Define standard Autopilot profiles for business use cases. Windows Update for Business & Autopatch Govern Windows Update for Business policies, update rings, feature updates, quality updates, and driver update deployment. Configure and manage Windows Autopatch policies and update rings. Monitor update compliance, deployment health, failures, and remediation actions; support pilot, phased, and broad rollout ring models. Drive Windows Evergreen and Windows-as-a-Service operating models. Policy, Compliance & Configuration Management Design and manage Intune configuration profiles, compliance policies, endpoint security policies, and settings catalog policies. Define compliance baselines for Windows endpoints; implement device restrictions, security controls, encryption policies, update policies, and configuration standards. Investigate policy conflicts, assignment failures, and non-compliant device scenarios; support conditional access enforcement based on compliance posture. Application Management & Company Portal Manage Win32, Microsoft Store, Microsoft 365 Apps, and enterprise application deployments through Intune. Support application packaging, detection rules, requirement rules, dependencies, supersedence, and uninstall workflows. Govern enterprise self-service application delivery through Company Portal; support Base Software and On-Demand Software delivery models. Endpoint Security & Modern Workplace Controls Configure and govern endpoint security policies in Intune: Microsoft Defender policies, Attack Surface Reduction rules, BitLocker encryption, Firewall policies, device compliance, local admin control (Endpoint Privilege Management), certificate and profile deployment. Work with security teams to remediate vulnerable and non-compliant devices; support Zero Trust endpoint access models. Entra ID, Hybrid & Cloud Management Support Microsoft Entra ID device registration and join scenarios; troubleshoot Entra joined, hybrid joined, and Intune-enrolled device issues. Support cloud attach and co-management awareness where legacy endpoint management exists. Automation, Reporting & Operational Excellence Automate repetitive Intune operations using PowerShell, Microsoft Graph API, Intune automation scripts, and reporting automation. Use and extend the AIM (Intune Automation Management) solu

Skill Requirements

: Microsoft Intune Modern Management Microsoft Intune Administration & Engineering Windows Modern Device Management Device Enrollment & Compliance Configuration Profiles Settings Catalog Endpoint Security Profiles Device Restrictions Compliance Policies Company Portal Intune RBAC (via Alice) Windows Provisioning & Updates Windows Autopilot Autopilot Pre-Provisioning Windows Update for Business Windows Autopatch Feature Update Policies Quality Update Policies Driver Update Management Delivery Optimization Infrastructure Build Client Environment Ownership Device Product-Line Governance (Modern Office Device, SW Developer Device, PAW, DevBoxes, GEW Basic) AIM (Intune Automation Management) — policy-as-code configuration Alice (IAM / RBAC Governance Tool) — RBAC change ownership Vanilla Image / OEM Factory Coordination Identity & Security Microsoft Entra ID Entra Join / Hybrid Join Conditional Access MFA Awareness BitLocker Management Microsoft Defender for Endpoint Policies Attack Surface Reduction Endpoint Hardening Zero Trust Concepts Endpoint Privilege Management (EPM) Application & Automation Win32 App Packaging for Intune Microsoft Store App Deployment Microsoft 365 Apps Deployment PowerShell Scripting Microsoft Graph API Intune Automation Power BI / Reporting KPI Definition & Measurement Design ITSM & Governance ServiceNow or equivalent ITSM tool Incident Management Problem Management Change Management Knowledge Management SLA / KPI Reporting Audit Evidence Support

Other Requirements

SCCM/MECM and Co-Management awareness Cloud Management Gateway awareness Endpoint Analytics KQL / Log Analytics Azure Automation Microsoft Graph advanced scripting Patch My PC or third-party patching tools Microsoft Defender XDR awareness Microsoft Sentinel / Splunk awareness Configuration-as-code concepts Self-healing / auto-remediation tooling German Language (B2) — preferred for DACH-region support rotations (confirm with account team) Educational Qualification Bachelor\'s Degree in Computer Science, Information Technology, Engineering, or equivalent experience. Preferred Certifications Microsoft Certifications Microsoft Certified: Endpoint Administrator Associate – MD-102 Microsoft Certified: Azure Administrator Associate – AZ-104 Microsoft 365 Certified: Administrator Expert Microsoft Security Fundamentals – SC-900 Service Management ITIL Foundation