Principal - EUC / MDM Platform Engineer

Business Introduction
GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.
Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.
Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Job Purpose

Build, automate and run the platform that manages every device 50,000+ employees across [X] countries depend on — Windows and macOS laptops and desktops, iOS and Android phones and tablets, corporate-owned and BYOD, plus the rugged, lab, clinical and shop-floor devices that follow none of the usual rules.

This is the hands-on build role for the device estate. The Platform Engineer takes architecture direction and a prioritised backlog and turns them into working, tested, automated, documented configuration in production. The expectation is engineering rather than administration: enrolment profiles, compliance policies, application packages and remediation scripts expressed as code and deployed through pipelines, not clicked through a console and remembered by whoever was on shift.

The role also runs what it builds. Platform Engineers own the operational health of the endpoint platform — diagnosing the awkward, intermittent, only-happens-on-that-hardware-revision problems that never reproduce in a lab, and eliminating the root cause rather than closing the ticket. Every change carries real blast radius: a bad compliance policy can lock 50,000 people out of their email before lunch.

Key Responsibilities

• Design, build, test and deploy endpoint configuration across the estate: Intune configuration and compliance policies, Autopilot and enrolment profiles, Windows Update rings, macOS configuration profiles, and iOS/Android enterprise policy.

• Build and maintain the provisioning experience — zero-touch deployment, enrolment journeys, and the out-of-box experience that determines whether a new starter is productive on day one or raising a ticket.

• Package, test and deploy applications at scale — Win32 and MSIX packaging, macOS packages, mobile app assignment and configuration, dependency and supersedence management.

• Implement to the reference architecture and standards set by the Principal Architect; raise a design challenge when reality does not match the design rather than quietly deviating.

• Deliver backlog items to production with the tests, telemetry, documentation and rollback path included — "done" means running and observable across the fleet, not merely configured for one pilot device.

• Automate everything that would otherwise be done twice: provisioning, enrolment, lifecycle, licence and asset reconciliation, reporting, and proactive remediation.

• Build detection and remediation scripts that fix problems on the device before the user notices, and instrument them so you know whether they worked.

• Express endpoint configuration as code in version control; build and maintain CI/CD pipelines for policy and package deployment with automated validation and staged ring-based rollout.

• Replace manual runbook steps with self-healing and self-service; treat a recurring manual task as a defect with a backlog item attached.

• Own operational health of assigned platforms: enrolment success rates, policy assignment and compliance reporting, patch and OS currency, application deployment success, and device performance.

• Investigate and resolve complex incidents and problems — third-line escalation for endpoint issues — and drive permanent root-cause elimination.

• Participate in an on-call rotation for major incidents affecting the device estate.

• Manage the continuous change stream from vendors: Windows and macOS feature updates, annual iOS and Android major releases, MDM platform updates and hardware model introductions. Test in a lab, assess compatibility, and roll out under control.

• Maintain patch, OS currency and vulnerability remediation to target; hunt and correct configuration drift.

• Implement and maintain endpoint security controls: disk encryption and key escrow, EDR deployment and health, application control, local privilege management, security baselines, and device compliance feeding Conditional Access.

• Remediate endpoint vulnerabilities in partnership with Cyber Security, at fleet scale and to SLA.

• Produce the evidence audits require — configuration baselines, patch compliance, change records — generated automatically wherever possible.

• Build to regulated-environment requirements where applicable, including GxP-qualified endpoints and the validation and change control they demand.

• Work daily with the Product Owner on refinement and estimation, and with the Architect on design; give honest estimates and flag risk early.

• Produce operational documentation, runbooks and knowledge articles good enough that the service desk can use them and the next engineer can pick the work up.

• Support and coach the service desk, deskside and field teams; reduce escalation volume by transferring capability, not by absorbing it.

• Mentor junior engineers and contribute to engineering standards and code review within the squad.

Professional Qualifications

• Bachelor's degree in Computer Science, Engineering or a related discipline, or equivalent demonstrable professional experience. Strong practical experience is an acceptable substitute for formal qualification.

• Relevant certifications desirable (e.g., Microsoft 365 Certified: Endpoint Administrator Associate or Expert, Jamf Certified Tech/Admin, Apple Certified Support Professional, Android Enterprise Professional, Azure Administrator, ITIL v4 Foundation).

Area of Specialisation

• Hands-on endpoint platform engineering — Microsoft Intune / Endpoint Manager, Autopilot, Windows Update for Business, Endpoint Analytics — at 50,000-device scale.

• Mobile device management engineering across iOS (Apple Business Manager, ADE/DEP, APNs, supervised devices) and Android Enterprise (work profile, fully managed, dedicated/kiosk, Managed Google Play), plus app protection and containerisation for BYOD.

• Complex endpoint troubleshooting across hardware, OS, identity, network and application layers, with root-cause elimination rather than ticket closure.

Experience Required

• Overall 10+ and 4+ years in IT engineering or endpoint operations, including 3+ years working hands-on with an enterprise MDM/UEM platform (Intune, Jamf, Workspace ONE or equivalent) in production.

• Experience engineering or supporting an estate of 5,000+ devices; comfortable with the difference between a small fleet and a large one.

• Demonstrable hands-on capability in Windows endpoint management via Intune (or MECM) and at least one mobile platform (iOS or Android enterprise) — at a level that includes troubleshooting, not only configuration.

• Practical experience packaging and deploying applications at scale, including detection logic and failure diagnosis.

• Working PowerShell proficiency with real examples of automation delivered into production, plus practical experience calling the Microsoft Graph API.

• Familiarity with Git and pull-request-based working; willingness to work configuration-as-code if not already doing so.

• Experience operating in an ITIL-aligned change and incident process, including ownership of production change against a live device fleet.

• Experience delivering within a Scrum or Kanban squad, including refinement, estimation and sprint commitment.

• Willingness to participate in an on-call rotation for major incidents.

• Fluent English, written and spoken; able to explain a technical issue to a non-technical colleague.

• Desirable:

• Experience in a regulated industry — pharmaceutical, life sciences, biotech, financial services or healthcare — including GxP/CSV/CSA and validated-endpoint change control.

• Specialised and frontline devices — rugged handhelds (Zebra, Honeywell), lab instrument workstations, clinical and field devices, kiosks, shared and multi-user workstations, scanners and shop-floor endpoints.

• Migration and transformation delivery — SCCM to Intune, Windows 10 to 11 at scale, MDM platform change, or on-premises to cloud-native device management.

• Virtual desktop and cloud PC — Azure Virtual Desktop, Windows 365, Citrix or VMware Horizon; image and profile management.

• Endpoint security engineering — Defender for Endpoint, WDAC/AppLocker, privilege management (BeyondTrust, Admin By Request), DLP on the endpoint, threat hunting in device telemetry.

• Certificate and PKI operations as they touch devices — SCEP, NDES, certificate lifecycle troubleshooting.

• Infrastructure-as-code tooling — Bicep, ARM or Terraform for supporting Azure resources.

• Collaboration platform adjacency — M365 workloads and how conditional access and app protection land on the device.

• Hardware and logistics exposure — OEM engagement, imaging and staging partners, asset management, secure disposal.

• Accessibility and assistive technology provisioning and testing.

Skills/Background

• Deep endpoint platform engineering across Intune / Endpoint Manager, Windows engineering (OS deployment, servicing, drivers, security baselines, Group Policy to Intune migration), macOS management (Jamf or Intune for Mac), and Microsoft Configuration Manager (SCCM/MECM) where a hybrid or co-management estate remains.

• Mobile device management engineering — iOS (Apple Business Manager, ADE/DEP, APNs, supervised devices, configuration profiles) and Android Enterprise (work profile, fully managed, dedicated/kiosk, Managed Google Play), plus app protection and containerisation for BYOD.

• Entra ID as it applies to devices — device identity and join states, Conditional Access and device compliance, certificate deployment (SCEP/PKCS), Windows Hello / passwordless.

• Application packaging and delivery — Win32/MSIX/PSADT, macOS packaging, detection rules, requirements, supersedence and uninstall logic that actually works.

• Advanced PowerShell — modules, error handling, parameterisation, idempotency; scripts written to be maintained by someone else and to run safely on 50,000 machines.

• Microsoft Graph API fluency — REST, delta queries, permission scopes, app-only auth, throttling and retry handling; automating Intune beyond what the console exposes.

• Version control and CI/CD — Git branching and pull request discipline, and pipeline authoring in Azure DevOps or GitHub Actions — with configuration-as-code applied to endpoint policy and packages.

• Monitoring and diagnostics — Log Analytics and KQL, Intune and Endpoint Analytics telemetry, DEX tooling (Nexthink, 1E or similar), Power BI reporting; instrumenting your own work so problems surface before users report them.

• Shell scripting for macOS/Linux (bash/zsh) where the estate requires it.

• Complex troubleshooting — methodical isolation of intermittent, multi-layer problems spanning hardware, OS, identity, network and application.

• ITIL-aligned practice — incident, problem and change management executed properly at enterprise scale, including credible change records and rollback plans.

• Blast-radius awareness — pilot rings, canary devices, and the habit of asking "what does this do to 50,000 people, including the ones on a plane" before pressing apply.

• Clear technical writing — runbooks, knowledge articles and design notes others can follow.

• Ownership — sees an item through to working across the fleet and stays with it when it misbehaves afterwards.

• Curiosity and self-direction — reads release notes, tests in a lab, and brings improvement ideas to refinement unprompted.

• Collaboration — works well with product, architecture, security, service desk and field teams; explains technical constraint without condescension.

• User empathy — remembers that a compliance policy is somebody's Monday morning, and that some users are three time zones and one bad connection away from help.

#AGTech

Skills

Application Packaging, Automation Technology, Cloud Infrastructure, Configuration Management (CM), Configuration Management Database (CMDB), Customer Service Operations, Cybersecurity, Data Analysis, Endpoint Management, Global Deployments, Incident Management, Information Security, Information Technology Infrastructure Library (ITIL), Microsoft Power Automate, Mobile Device Management (MDM), Network Security, Service Delivery, Services Management, System Administration, Technical Support, Troubleshooting

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at [email protected] to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing [email protected], so that we can confirm to you if the job is genuine.