Cynaxus is hiring a Level 3 Desktop Deployment Engineer to own modern Windows endpoint delivery for our managed-services clients. This is expert-level work in the Microsoft endpoint stack — Autopilot, Intune, and the 365 administrative portals — for clients whose endpoints are the front line of their security posture.
About the role
A laptop that enrolls wrong, provisions slow, or ships soft is not an inconvenience — it is a finding. You will design and run endpoint programs where enrollment is zero-touch, provisioning is predictable, troubleshooting is methodical, and the Windows 11 configuration is hardened to its furthest practical extreme without breaking the business that has to use it.
What you'll do
Architect and operate Autopilot deployments end-to-end: hardware-hash and dynamic-group strategy, enrollment profiles, ESP tuning, hybrid and Entra-native join scenarios, and the unglamorous diagnostics when enrollment breaks at scale. Build Intune configuration as a coherent system — configuration and compliance policies, app deployment, Windows Update rings, PowerShell remediation scripts — not a pile of one-off profiles. Harden Windows 11 endpoints to the edge of what each client's operations can sustain: security baselines and CIS benchmarks as the floor, then ASR rules, Credential Guard, Application Control (WDAC/AppLocker), BitLocker policy, LAPS, local-privilege elimination, and attack-surface reduction beyond the defaults. Troubleshoot the deep failures — enrollment, policy conflict, provisioning, update — that tier-1 and tier-2 cannot, and document the fix into a runbook every time.
What you bring
Expert, current, hands-on depth in Autopilot, Intune, and the Microsoft 365 portal ecosystem — this role will not suit someone who managed it from a distance. Demonstrated mastery of Windows 11 configuration across enrollment, provisioning, troubleshooting, and hardening, including security baselines, ASR, and application control in production at organizational scale. Relevant Microsoft certifications (MD-102 or equivalent endpoint-administrator depth; security certifications valued). The judgment to harden aggressively without stranding the help desk. Documentation habits that survive contact with an auditor.
What we offer
Endpoint programs you design rather than inherit. Clients who treat hardening as a requirement, not an argument. Senior security and infrastructure peers one message away. Compensation that reflects level-3 depth. US-based, remote-first culture.