Intune Engineer

Dunhill Government Solutions is hiring an Intune Engineer to support the Endpoint Engineering Lead in modernizing a federal agency's Microsoft Intune endpoint management platform. This is a hands-on, mid-level engineering role: working to the Lead's direction and established standards, you will build, test and implement the policy, provisioning and application delivery changes that move the organization from an Active Directory-anchored, co-managed estate to a cloud-native, Intune-first one. Hybrid in Washington, DC, two days per week on site.

Responsibilities:

• Cloud-native join transition: assist with the migration from Hybrid Entra ID join to Entra-native join, including pilot testing, device object cleanup, cutover steps and identifying on-premises dependencies


• Group Policy migration: review the AD GPO estate, translate settings into Intune settings catalog and ADMX-backed policy, test for conflicts and MDM-versus-GPO precedence, and document retired GPOs


• Legacy dependency remediation: rework domain-dependent services for cloud-native endpoints (logon scripts, mapped drives, print, local admin passwords, Kerberos-dependent applications and file shares)


• Provisioning and packaging: configure Windows Autopilot profiles and Enrollment Status Page settings; convert the SCCM catalog into Intune Win32, winget and Enterprise App Catalog deployments with detection rules, dependencies and supersedence


• Update management: deploy Windows quality and feature updates and Microsoft 365 Apps updates, including ring design, channels, deferrals, deadlines, expedited releases and rollback


• Policy and security: build configuration, compliance and certificate profiles (SCEP/PKCS, PIV smart card, 802.1X, VPN); apply NIST, CIS and STIG baselines; support Conditional Access, CDM reporting and patch compliance against federal Binding Operational Directives


• Automation: author PowerShell for packaging, detection, remediation and reporting; use the Microsoft Graph API for bulk operations and drift detection


• Follow Intune releases and Message Center posts, test changes in a pilot ring, maintain runbooks and documentation, and provide escalation support for complex endpoint issues

Required qualifications:

• Bachelor's degree in Information Technology, Computer Science or a related field, or equivalent relevant experience


• 3-5 years in enterprise endpoint management, including at least 2 years of hands-on Microsoft Intune work beyond day-to-day console administration


• Familiarity with Hybrid Entra ID join and cloud-native Entra join; working knowledge of Active Directory Group Policy


• Building Intune policy with the settings catalog and ADMX-backed profiles; Windows Autopilot configuration and troubleshooting


• Application packaging, including Intune Win32 packages with detection and requirement rules


• Deploying Windows quality and feature updates; familiarity with Microsoft 365 Apps update channels


• Entra ID dynamic and assigned groups, Conditional Access and device identity; working PowerShell scripting


• Familiarity with NIST, CIS or STIG hardening frameworks


• Able to work a hybrid schedule with two days per week on site in Washington, DC


• US citizen (no dual citizenship, per agency requirements)

Preferred: Federal, DoD or similarly regulated environment experience, including GCC High tenants; hands-on Hybrid-to-cloud-native join migration or SCCM-to-Intune catalog conversion; certificate delivery via SCEP or PKCS and PIV smart card authentication; Windows LAPS in Entra ID, Windows Hello for Business cloud Kerberos trust and Universal Print; Group Policy analytics; federal PKI (derived PIV, NDES / Certificate Connector, Microsoft Cloud PKI); Intune Suite and Defender for Endpoint; Recast Software, PSAppDeployToolkit, Patch My PC or similar tooling.

Location: Washington, DC — hybrid (two days per week on site).

US Citizenship and the ability to pass a federal background investigation in order to be granted access to sensitive information.

Compensation: $86,000 - $113,000 per year

#cjpost