Systems Engineer III - Endpoint Management

This Systems Engineer III - Endpoint Management position is with Sprouts Farmers Market in Phoenix, AZ. Overview The Systems Engineer III – Endpoint Management is a hands-on engineering role responsible for the day-to-day management, configuration, and continuous improvement of Sprouts’ corporate and retail endpoint fleet across Windows and macOS. Working within a small, high-impact endpoint team, this engineer builds and maintains device configuration, application deployment, patching, and compliance across Microsoft Intune, Microsoft Configuration Manager (SCCM), Tanium, and Kandji. This is an execution-focused engineering role. Endpoint strategy and platform direction are set in partnership with the Systems Engineering Supervisor and senior engineers; this position contributes technical recommendations, owns the build and rollout, and serves as an escalation point for the service desk. The role reports to our Store Support Office in Phoenix, AZ, with a hybrid work arrangement requiring in-office presence Tuesday through Thursday. Overview of Responsibilities • Build, deploy, and maintain device configuration profiles, compliance policies, and security baselines across Windows and macOS using Microsoft Intune and Kandji. • Administer Microsoft Configuration Manager (SCCM) for the existing store and corporate Windows support the ongoing migration of those devices to Intune and Windows Autopilot. • Manage zero-touch enrollment programs including Windows Autopilot and Apple Business Manager (ABM/DEP), including hardware hash management, enrollment status pages, and vendor drop-ship coordination. • Own operating system patching and feature update campaigns using Tanium and Intune update rings, including ring design, pilot validation, phased rollout across time zones, communication, and rollback planning. • Package, test, and deploy applications and application updates across Windows and macOS using Tanium, Intune, Patch My PC, and Kandji, favoring automated role-based assignment over manual installation. • Develop and maintain PowerShell automation for endpoint lifecycle tasks including remediation scripts, reporting, bulk operations, and Microsoft Graph API interactions. • Configure and maintain endpoint security controls including disk encryption, local administrator management, certificate deployment, and CIS benchmark enforcement in partnership with the Information Security team. • Support Conditional Access and device compliance policy configuration within Microsoft Entra ID, ensuring devices meet posture requirements before accessing corporate resources. • Diagnose and resolve escalated tier 3 endpoint incidents spanning hardware, operating system, application, and management-policy layers; perform root cause analysis and implement preventive fixes. • Create and maintain operational documentation including enrollment procedures, policy configurations, deployment runbooks, and knowledge base articles for the service desk. • Serve as a technical escalation point for the service desk and provide coaching and knowledge transfer to support staff and junior engineers. • Participate in a rotating on-call schedule providing first-line tier 3 support for server and infrastructure issues. • Support off-hours deployment windows as required for retail store maintenance across multiple time zones. • Evaluate new endpoint tooling and capabilities through proof-of-concept work and provide recommendations to the Systems Engineering Supervisor and senior engineers. Qualifications Required • Bachelor’s degree in Computer Science, Information Technology, or equivalent professional experience. • 3+ years in endpoint engineering, systems engineering, or device management roles within an enterprise environment. • Hands-on proficiency with Microsoft Intune, including configuration profiles, compliance policies, application deployment, and update rings. • Working experience with Microsoft Configuration Manager (SCCM/MECM) for software distribution, operating system deployment, or patch management. • Hands-on experience with Windows Autopilot enrollment, including hardware hash collection, deployment profiles, and Enrollment Status Page configuration. • Proficiency in PowerShell for endpoint automation, scripting, and reporting; ability to write and troubleshoot scripts independently. • Working knowledge of Microsoft Entra ID, Conditional Access, and device compliance concepts. • Experience planning and executing patching or operating system upgrade campaigns across a distributed device fleet. • Familiarity with endpoint security frameworks such as CIS Benchmarks and standard patch management practices. • Strong problem-solving and analytical skills, with the ability to clearly explain technical concepts to both technical and non-technical audiences. Preferred • Experience with Tanium for patching, software deployment, or compliance enforcement. • Experience managing macOS endpoints through Kandji, Jamf, or a comparable Apple MDM platform, including Apple Business Manager. • Experience supporting endpoints in a retail, distributed-site, or multi-time-zone environment. • Experience with third-party patching platforms such as Patch My PC. • Familiarity with ChromeOS device management and kiosk configuration. • Additional scripting experience with Bash, Python, or Microsoft Graph API. • Exposure to Microsoft 365, Windows Server, or VMware vSphere administration. • Relevant certifications such as Microsoft MD-102 (Endpoint Administrator Associate), AZ-104, or Apple/Kandji certifications. Core Competencies • Execution and Follow-Through: Delivers work that is tested, documented, and complete; sets measurable goals and pursues them with a sense of urgency. • Automation Mindset: Looks for repetitive manual work and eliminates it through scripting, policy, and process improvement. • Security Orientation: Integrates security thinking into every aspect of device and application lifecycle management. • Customer Focus: Prioritizes end-user experience and business needs while maintaining security and compliance standards. • Communication: Clearly conveys technical concepts to both technical and non-technical stakeholders; actively listens and collaborates across teams. • Positive Approach: Demonstrates a constructive attitude in challenging situations and inspires others with a forward-looking outlook. Work Environment • Hybrid schedule based out of the Sprouts Store Support Office in Phoenix, Arizona, with in-office presence Tuesday through Thursday. • Participation in a rotating on-call schedule of approximately one week in eight. • Availability for off-hours and weekend maintenance windows supporting retail store deployments across multiple time zones. • Occasional travel to retail locations or distribution centers may be required. Benefits In addition to a rewarding career, Sprouts offers a comprehensive program to help support you and your family. These programs include: • Competitive pay • Sick time plan that you can use to support you or your immediate families health • Vacation accrual plan • Opportunities for career growth • 15% discount for you and one other family member in your household on all purchases made at Sprouts • Flexible schedules • Employee Assistance Program (EAP) • 401(K) Retirement savings plan with a generous company match • Company paid life insurance • Contests and appreciation events throughout the year full of prizes, food and fun! Eligibility requirements may apply for the following benefits: • Bonus based on company and/or individual performance • Affordable benefit coverage, including medical, dental and vision • Health Savings Account with company match • Pre-tax Flexible Spending Accounts for healthcare and dependent care • Company paid short-term disability coverage • Paid parental leave for both mothers and fathers • Paid holidays Get Paid Every Day! Sprouts Farmers Market offers DailyPay - if you’re hired as an eligible employee, you’ll be able to transfer the money you’ve already earned at no extra cost, and get it the next business day, for free.  We offer DailyPay so you don’t have to wait for payday to access the money you’ve already worked for. With DailyPay, you can see how much you’ve made every day and you can transfer your money any time before payday. You can learn more by visiting https://www.dailypay.com/partners/sprouts-farmers-market/. Why Sprouts Grow with us! If you have a passion for inspiring people and a flair for fresh food, consider applying for a job at Sprouts! With a focus on customer service, our neighborhood grocery stores offer high-quality, farm fresh produce, natural meats, plenty of scoop-your-own bulk goods and much more in a fun, friendly, old-fashioned farmer’s market setting.  Come grow your career in healthy living with a fast-paced, rapidly growing company and teams that pride themselves on empowering others along their journey. The above statements are intended to describe the general nature and level of the work being performed by people assigned to this work. This is not an exhaustive list of all duties, responsibilities, and requirements. Sprouts’ management reserves the right to amend and change duties, responsibilities, and requirements to meet business and organizational needs as necessary. Sprouts will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the Fair Chance in Hiring Ordinance. California Residents: We collect information in accordance with California law, please see here for more information.