Dunhill Government Solutions is hiring an Intune Engineer to support the Endpoint Engineering Lead in modernizing a federal agency's Microsoft Intune endpoint management platform. This is a hands-on, mid-level engineering role: working to the Lead's direction and established standards, you will build, test and implement the policy, provisioning and application delivery changes that move the organization from an Active Directory-anchored, co-managed estate to a cloud-native, Intune-first one. Hybrid in Washington, DC, two days per week on site.
Responsibilities:
- Cloud-native join transition: assist with the migration from Hybrid Entra ID join to Entra-native join, including pilot testing, device object cleanup, cutover steps and identifying on-premises dependencies
- Group Policy migration: review the AD GPO estate, translate settings into Intune settings catalog and ADMX-backed policy, test for conflicts and MDM-versus-GPO precedence, and document retired GPOs
- Legacy dependency remediation: rework domain-dependent services for cloud-native endpoints (logon scripts, mapped drives, print, local admin passwords, Kerberos-dependent applications and file shares)
- Provisioning and packaging: configure Windows Autopilot profiles and Enrollment Status Page settings; convert the SCCM catalog into Intune Win32, winget and Enterprise App Catalog deployments with detection rules, dependencies and supersedence
- Update management: deploy Windows quality and feature updates and Microsoft 365 Apps updates, including ring design, channels, deferrals, deadlines, expedited releases and rollback
- Policy and security: build configuration, compliance and certificate profiles (SCEP/PKCS, PIV smart card, 802.1X, VPN); apply NIST, CIS and STIG baselines; support Conditional Access, CDM reporting and patch compliance against federal Binding Operational Directives
- Automation: author PowerShell for packaging, detection, remediation and reporting; use the Microsoft Graph API for bulk operations and drift detection
- Follow Intune releases and Message Center posts, test changes in a pilot ring, maintain runbooks and documentation, and provide escalation support for complex endpoint issues
Required qualifications:
- Bachelor's degree in Information Technology, Computer Science or a related field, or equivalent relevant experience
- 3-5 years in enterprise endpoint management, including at least 2 years of hands-on Microsoft Intune work beyond day-to-day console administration
- Familiarity with Hybrid Entra ID join and cloud-native Entra join; working knowledge of Active Directory Group Policy
- Building Intune policy with the settings catalog and ADMX-backed profiles; Windows Autopilot configuration and troubleshooting
- Application packaging, including Intune Win32 packages with detection and requirement rules
- Deploying Windows quality and feature updates; familiarity with Microsoft 365 Apps update channels
- Entra ID dynamic and assigned groups, Conditional Access and device identity; working PowerShell scripting
- Familiarity with NIST, CIS or STIG hardening frameworks
- Able to work a hybrid schedule with two days per week on site in Washington, DC
- US citizen (no dual citizenship, per agency requirements)
Preferred: Federal, DoD or similarly regulated environment experience, including GCC High tenants; hands-on Hybrid-to-cloud-native join migration or SCCM-to-Intune catalog conversion; certificate delivery via SCEP or PKCS and PIV smart card authentication; Windows LAPS in Entra ID, Windows Hello for Business cloud Kerberos trust and Universal Print; Group Policy analytics; federal PKI (derived PIV, NDES / Certificate Connector, Microsoft Cloud PKI); Intune Suite and Defender for Endpoint; Recast Software, PSAppDeployToolkit, Patch My PC or similar tooling.
Location: Washington, DC — hybrid (two days per week on site).
US Citizenship and the ability to pass a federal background investigation in order to be granted access to sensitive information.
Compensation: $86,000 - $113,000 per year
#cjpost