Senior Systems Administrator, Endpoint Management & Patching
Description
POSITION TITLE: Senior Systems Administer, Endpoint Management & Patching
STATUS: Exempt
COMPENSATION RANGE: $125,000 - $140,000 annually with 4% bonus potential
LOCATION: Based out of our beautiful West Creek Office, located at 12580 West Creek Pkwy, Richmond, VA 23238. Hybrid schedule is offered, after in-office training period is completed.
REPORTS TO: IT Infrastructure & Systems Architecture Senior Manager
DEPARTMENT: IS
POSITION SUMMARY:
The Senior Systems Administrator, Endpoint Management & Patching is responsible for the administration, health, and continued improvement of the organization’s Microsoft endpoint-management and software-deployment platforms. The environment uses Microsoft Intune to manage Windows workstations and mobile devices, while Microsoft Configuration Manager supports Windows Server patching, application deployment, imaging, inventory, and related systems-management functions.
This is a hands-on engineering and operations role for someone who understands how to keep automated management processes healthy, identify when they fail, and drive issues through resolution. The successful candidate will have meaningful production experience with Configuration Manager, Intune, PowerShell, application packaging, software updates, and enterprise troubleshooting.
The position will also contribute to the organization’s modernization strategy, including greater use of Intune, Windows Autopilot, Microsoft Entra ID joined devices, automation, and cloud-based management practices.
PRIMARY DUTIES
- Administer and troubleshoot Microsoft Configuration Manager, including site and component health, clients, collections, queries, deployments, task sequences, software updates, maintenance windows, and Cloud Management Gateway services.
- Administer Microsoft Intune configuration profiles, compliance policies, application assignments, platform scripts, proactive remediations, device groups, assignment filters, update rings, and driver-management policies.
- Manage Windows Server patching and oversee workstation patching through Intune update rings, reporting, exception handling, and follow-up on unsuccessful or incomplete installations. Develop practical procedures and train the Desktop Support team to perform routine workstation patch administration, compliance monitoring, and first-level troubleshooting, while providing engineering support for complex issues and platform changes.
- Package, test, deploy, and maintain applications for Configuration Manager and Intune using MSI and EXE installers, PowerShell, and the PowerShell App Deployment Toolkit. Develop reliable detection methods, installation logic, dependencies, and rollback processes.
- Administer Patch My PC integrations with Configuration Manager and Intune, monitor synchronization and publishing activity, and troubleshoot third-party application update failures.
- Maintain operating-system deployment task sequences, Windows installation media, driver packages, hardware-model collections, and related imaging processes while supporting the transition toward Windows Autopilot.
- Troubleshoot Configuration Manager client health, software-deployment failures, update-compliance issues, task-sequence problems, and device-management exceptions across internal, remote, and segmented environments.
- Support vulnerability remediation by translating security findings into tested application, configuration, or patch deployments and validating remediation outcomes.
- Maintain integrations with Apple Business Manager and support certificate, token, device-compliance, configuration, and application-management requirements for supported mobile platforms.
- Coordinate lifecycle management for platform certificates, application secrets, service accounts, shared credentials, and administrative access in accordance with security and operational requirements.
- Create and maintain practical runbooks, troubleshooting procedures, escalation paths, and recurring operational checklists so that critical knowledge is documented and transferable.
- Identify opportunities to automate manual processes, improve monitoring and reporting, reduce deployment failures, and modernize endpoint provisioning and management.
MINIMUM EDUCATIONAL/EXPERIENCE QUALIFICATIONS
Bachelor’s degree in information technology, computer science, information systems, or a related discipline, or an equivalent combination of education and relevant professional experience. Several years of progressively responsible experience supporting enterprise endpoint management, systems management, application deployment, or patching platforms is preferred.
MINIMUM SKILL QUALIFICATIONS
- Hands-on experience administering Microsoft Configuration Manager in a production enterprise environment.
- Experience administering Microsoft Intune for Windows device management, policies, applications, updates, and reporting.
- Experience managing Windows Server software updates, including deployment groups, maintenance windows, exceptions, and troubleshooting.
- Demonstrated application-packaging experience using MSI and EXE installers, silent installation parameters, detection methods, and PowerShell.
- Experience with PowerShell App Deployment Toolkit or a comparable enterprise application-packaging framework.
- Experience creating and maintaining Configuration Manager collections, queries, task sequences, Automatic Deployment Rules, and Software Update Groups.
- Working knowledge of Active Directory, Group Policy, Microsoft Entra ID, PKI certificates, role-based access, and enterprise credential-management practices.
- Ability to analyze logs, troubleshoot complex deployment or client-health problems, identify root causes, and coordinate resolution across technical teams.
- Strong documentation and communication skills, with the ability to turn technical processes into usable operational guidance.
PREFERRED QUALIFICATIONS
- Experience administering Patch My PC with Microsoft Configuration Manager and Intune.
- Experience with Windows Autopilot and Microsoft Entra ID joined device deployments.
- Experience supporting Apple Business Manager integrations and mobile-device management through Intune.
- Experience with Configuration Manager Cloud Management Gateway, HTTPS/PKI configuration, or clients in segmented and DMZ environments.
- Experience with operating-system deployment, driver automation, SQL Server support for Configuration Manager, or vulnerability-remediation programs.
- Familiarity with Azure Arc, Azure Update Manager, or other hybrid server-management technologies.
- Microsoft 365 Certified: Endpoint Administrator Associate (MD-102), or other relevant Microsoft endpoint management certifications, preferred.
BENEFITS OVERVIEW
At VA Farm Bureau, we provide an exceptional benefits package, including ongoing job development and support in all roles, paid training and continuing education reimbursement, medical and dental insurance available on your first day, generous employee 401K contribution, excellent Paid Time off (PTO) plan and more!
Virginia Farm Bureau Companies provide equal employment opportunity in all aspects of employment without regard to race, color, national origin, religion, gender, pregnancy, age, disability, orientation or veteran status.