Senior Modern Workplace Engineer

About Onit We're redefining the future of legal operations through the power of AI. Our cutting-edge platform streamlines enterprise legal management, matter management, spend management and contract lifecycle processes, transforming manual workflows into intelligent, automated solutions. We’re a team of innovators using AI at the core to help legal departments become faster, smarter, and more strategic. As we continue to grow and expand the capabilities of our new AI-centric platform, we’re looking for bold thinkers and builders who are excited to shape the next chapter of legal tech. If you're energized by meaningful work, love solving complex problems, and want to help modernize how legal teams operate, we’d love to meet you. Position Summary This is a hands-on Senior Modern workplace engineer role focused on modern endpoint engineering, device identity, security, automation and lifecycle management. The role will own and evolve Microsoft's modern workplace stack with Microsoft Intune and Windows Autopilot at its core, integrated with Microsoft Entra ID, Conditional Access, endpoint security, application deployment and patching. The successful candidate should be strong enough to solve complex L3 issues independently, but broad enough to understand how endpoint, identity, security and user experience work together. Onit's technology environment changes quickly. The successful candidate will be evaluated not only on what they already know, but on how effectively they learn, apply and operationalize new capabilities. What This Role Is Expected to Deliver • Build a secure, scalable and low-touch endpoint platform for Windows devices, with increasing capability across macOS. • Reduce manual administration through PowerShell, Microsoft Graph and proactive remediation/automation. • Improve device compliance, deployment quality, patch posture and endpoint security without creating unnecessary friction for users. • Own endpoint-related projects from design and pilot through production rollout, documentation, change communication and operational handover. • EPM, SAAS Management, Shadow IT/AI and AI Governance are key projects in Pipeline. Key Responsibilities • Design, deploy and administer Microsoft Intune for device compliance, configuration profiles, security baselines, enrollment, application deployment and update management. • Own Windows Autopilot end to end, including device registration, hardware hashes, deployment profiles, Enrollment Status Page (ESP), user-driven and pre-provisioned scenarios, troubleshooting and lifecycle operations. • Design and maintain Conditional Access controls tied to compliant/corporate devices, MFA and Zero Trust access principles in partnership with security and identity stakeholders. • Manage the endpoint-related Microsoft Entra ID surface, including device identity, registration, join states, authentication dependencies and access troubleshooting. • Package, test and deploy Win32, Microsoft Store and line-of-business applications, including detection rules, dependencies, install/uninstall logic and remediation of failed deployments. • Build PowerShell and Microsoft Graph automation for reporting, compliance, device operations, configuration validation and repetitive administration. • Create and maintain proactive remediation/detection-remediation logic to address configuration drift, device health and recurring endpoint issues before they become tickets. • Own Windows patch/update strategy using Windows Update for Business, update rings and related Microsoft capabilities; support application patching and verification processes. • Implement and improve endpoint security controls including BitLocker, LAPS, attack-surface reduction/security baselines and integration with enterprise security tooling such as CrowdStrike or Microsoft Defender concepts. • Support and progressively deepen macOS management capability using Jamf Pro/Apple Business Manager, ADE, FileVault and macOS compliance where applicable. • Act as the L3 escalation point for complex enrollment failures, policy conflicts, Autopilot provisioning issues, application deployment failures and device compliance problems. • Work across Microsoft 365 services such as OneDrive, SharePoint, Teams and Exchange Online where endpoint or identity policies intersect with the user experience. • Evaluate new Microsoft/Apple endpoint capabilities, and recommend production adoption when they improve security, supportability or user experience. • Create technical documentation, SOPs and runbooks; mentor other IT team members and transfer knowledge rather than becoming a single point of dependency. Required Skills - Must Have • Strong hands-on Microsoft Intune administration in an enterprise environment. • Strong Windows Autopilot implementation and troubleshooting experience. • Strong understanding of compliance policies, configuration profiles, security baselines and device lifecycle management. • Hands-on application packaging/deployment using Win32 (.intunewin) or equivalent enterprise packaging methods, including detection and dependency logic. • Hands-on Microsoft Entra ID and Conditional Access experience, especially device-based access and compliance scenarios. • Strong L3 troubleshooting ability across enrollment, policy, application deployment, authentication and compliance issues. • Strong PowerShell scripting skills for automation and troubleshooting. • Practical endpoint security knowledge including disk encryption, endpoint hardening, patching and least-privilege concepts. • Ability to independently plan and execute technical changes/projects with pilots, rollback thinking, stakeholder communication and post-change validation. • PIM, SSO concepts (SAML/OIDC), enterprise application registration and broader Entra identity administration. • Jamf Pro, Apple Business Manager/ADE, FileVault and macOS administration. Adjacent Skills - Good to Have / Learn Quickly • Microsoft Graph API automation and reporting. • BeyondTrust Endpoint Privilege Management (EPM), Microsoft EPM or similar least-privilege tooling. • CrowdStrike, Microsoft Defender for Endpoint or comparable endpoint security platforms. • Microsoft 365 migration or tenant-to-tenant migration experience. • ISO 27001, SOC 2, GDPR or similar control/compliance environments. What Success Looks Like • Takes independent ownership of the Intune/Autopilot/Entra endpoint stack and becomes the escalation point for complex endpoint problems. • Automates recurring endpoint work and reduces avoidable manual administration/tickets. • Improves compliance, patching and endpoint security posture while keeping user experience practical. • Builds working knowledge in adjacent areas such as Jamf/macOS, EPM and broader identity rather than remaining an Intune-only specialist. • Demonstrates learnability: can identify a knowledge gap, self-learn, test in a lab/pilot, apply the capability in production, document it and transfer the knowledge to others. Experience & Qualifications • 8+ years relevant experience across enterprise IT, Microsoft 365, endpoint/security or related infrastructure disciplines. • Demonstrated experience owning production systems and resolving complex technical problems, not only following predefined operational procedures. • Experience working with distributed/global stakeholders and managing technical changes across business teams is preferred. • Bachelor's degree or equivalent practical experience in Information Technology, Computer Science or a related discipline. Preferred Certifications • Microsoft Certified: Endpoint Administrator Associate (MD-102) • Microsoft 365 Administrator / MS-102 or equivalent Microsoft 365 administration certification • Microsoft Identity and Access Administrator (SC-300) - preferred • Jamf certification - advantage, not mandatory Benefits & Perks That Support You: Onit offers a comprehensive total rewards package designed to support the whole employee at work and beyond: Health Coverage: Employee and immediate family members. Time Away: Flexible paid time off and 10 company paid holidays annually. Family Support: Exceptional paid leave for birth parents, non-birth parents, and caregivers.  Onit also offers surrogacy and adoption reimbursement. Income Protection: 100% employer-paid life and disability insurance. Additional Coverage Options: Voluntary benefits including hospital indemnity, critical illness, accident. Tax-Advantaged Accounts: Flexi, NPS. Community Engagement: One paid volunteer day each year to give back to the community. Our Commitment to Applicants We know that not everyone will check every box in a job description. At Onit, we value diversity, inclusion, and authenticity. If you’re excited about this role but your experience doesn’t align perfectly with every qualification, we encourage you to apply. You may be exactly who we’re looking for. Onit Values  Customer First - Customer success is our success. We deliver value, listen, and act on customer needs.  Purposeful Innovation - Innovation fuels our growth. We harness creativity to solve problems and lead with the intentions and expertise.  Win as One - Teamwork is how we win. We are accountable, act with integrity, and communicate openly.  Intentional Growth - Our people are the difference. We create an environment with compelling work, impactful contributions, and career growth.