Job Description:
Role Overview
A senior, multiskilled engineer responsible for the design, deployment, optimisation, and day-to-day operation of enterprise endpoint-management and Windows platforms. The role spans Windows client and Server OS build and lifecycle, Remote Desktop Services (RDS) and RDP remote-access management, patch management and compliance (WSUS, SCCM/MECM, and Ivanti), software packaging and deployment, OS deployment (OSD), and supporting Windows Server and virtualisation environments. As a Level 10 specialist, the engineer provides advanced troubleshooting and strategic guidance, leads root-cause analysis for major incidents, drives automation, and mentor junior (L1/L2) team members — working within ITIL-aligned service delivery and corporate security standards.
Due to the nature of the work and the customers we support, the successful candidate must be eligible to meet UK Government and contractual personnel security requirements, including the applicable residency requirements for the role, and have the right to work in the United Kingdom. Some roles may also be subject to nationality requirements where these are necessary to meet UK Government or contractual security obligations.
Please note this role will require attendance on-site 5 days a week.
Key Responsibilities
Windows Server & Remote Desktop Services (RDS / RDP)
Design, build, configure, patch, and maintain enterprise Windows Server platforms — including Windows Server 2016/2019/2022 and 2025 — covering Active Directory, GPO, DNS, and DHCP.
Manage and support Remote Desktop Services (RDS) — Session Host, Connection Broker, Gateway, Web Access, and Licensing — including farm design, session management, and user-profile/FSLogix configuration.
Administer, secure, and troubleshoot the Remote Desktop Protocol (RDP) — connectivity, certificates, encryption/NLA, Group Policy controls, and remote-access performance.
Endpoint Management — SCCM/MECM, WSUS & Ivanti
Design, implement, and maintain the SCCM/MECM hierarchy (Primary/Secondary sites, Distribution Points, Management Points, Software Update Points); define and enforce policies, standards, and operating procedures.
Administer WSUS and Software Update Points; manage Ivanti (and comparable endpoint/patch-management platforms) for patching, software distribution, and endpoint control.
Monitor site/endpoint health and client status; maintain boundaries, collections, and client settings; perform site backup and disaster-recovery validation.
Patch Management & Compliance
Plan and execute enterprise patching strategies for Windows client/Server OS, Office, and third-party applications using WSUS, SCCM ADRs, and Ivanti.
Configure, test, and deploy Automatic Deployment Rules (ADRs) and Compliance Baselines; monitor compliance reports and remediate non-compliant endpoints and servers.
Collaborate with IT Security to align patching with corporate security policies and vulnerability-remediation targets.
Software Deployment & Application Packaging
Package, test, and deploy applications across enterprise endpoints and RDS hosts using SCCM task sequences; automate deployments with PowerShell and advanced techniques.
Resolve deployment issues including application conflicts and installation failures; maintain software inventory, license tracking, and reporting.
Operating System Deployment (OSD) & Windows Lifecycle
Manage Windows OS imaging, boot images, driver packages, and task sequences; lead in-place upgrades, bare-metal deployments, and device/server refresh cycles.
Maintain a library of standardised enterprise images (client and Server) aligned with IT standards; optimise OSD workflows for reliability and minimal downtime.
Automation, Reporting & Incident Leadership
Drive automation for patching, provisioning, monitoring, and compliance using PowerShell (and tools such as Ansible/PowerCLI where applicable).
Develop SQL queries and SSRS reports for inventory, compliance, deployment, and patch status; track…