Sr Lead, Infra End User Computing

About Northern Trust

As a global leader in innovative wealth management, asset servicing, asset management and banking services, Northern Trust (Nasdaq: NTRS) is proud to guide the world’s most successful individuals, families, corporations and institutions.

Since 1889, we have aligned our efforts with our three guiding Principles That Endure: Service, Expertise, and Integrity. Together, they reflect the three cornerstones of business conduct which we strive to instill in our employees, whom we call partners, and to provide to our clients and the communities we serve worldwide.

With more than 135 years of financial experience and over 24,000 partners, we serve the world’s most sophisticated clients using leading technology and exceptional service.

Position : Sr Lead, Infra EUC

The Sr.Lead Engineer, End User Computing is a senior technical role responsible for designing, implementing and continuously improving secure, resilient and user-centered endpoint services. The role supports Windows, macOS, mobile, browser, application-delivery and virtual workspace capabilities across a global, regulated enterprise. It combines hands-on engineering with architecture, automation, security, governance, documentation and technical leadership.

The engineer will support the current hybrid environment while advancing the EUC roadmap toward Intune-centered governance, cloud-managed provisioning and servicing, modern application delivery, intelligent automation, unified reporting, stronger lifecycle controls and reduced reliance on legacy infrastructure and scripting.

KEY RESPONSIBILITIES

· Design and implement enterprise endpoint solutions across Windows, macOS, iOS, Android, Cloud PC, virtual workspaces and supported device-ownership models.

· Engineer and maintain Microsoft Intune, Configuration Manager/SCCM, Windows Autopilot, Windows Autopatch, Windows Update for Business, Jamf, Active Directory, Microsoft Entra ID, Group Policy and related services.

· Define target-state architectures, configuration baselines, deployment patterns, technical standards, test criteria, support models and operational acceptance requirements.

· Lead device provisioning, enrollment, configuration, patching, operating-system upgrades, driver and firmware servicing, recovery, retirement and lifecycle cleanup.

· Develop deployment-ring strategies, controlled pilots, success criteria, rollback plans, exception processes and evidence requirements for enterprise changes.

· Translate security, risk, audit and regulatory requirements into enforceable endpoint controls, monitoring, remediation and audit-ready evidence.

· Engineer capabilities supporting device compliance, encryption, least privilege, endpoint hardening, certificates, trust stores, application control, secure administration and vulnerability remediation.

· Develop secure and supportable automation using PowerShell, Microsoft Graph, REST APIs, proactive remediations and approved workflow tools.

· Replace fragile or legacy scripts with version-controlled solutions that include logging, error handling, peer review, least privilege and safe rollback.

· Build endpoint-health monitoring, compliance reporting, deployment telemetry, failure analysis and operational dashboards that improve decision-making.

· Modernize application intake, packaging, certification, deployment, patching, retirement and self-service delivery through Intune-first and automation-led practices.

· Engineer and govern enterprise browser policies, extensions, standards, lifecycle controls and controlled exceptions across Microsoft Edge, Chrome and Safari.

· Support legacy dependency remediation, including IE Mode, embedded-browser, URL, script, certificate and application compatibility dependencies.

· Produce complete engineering documentation, including requirements, designs, implementation plans, test plans, runbooks, RACI assignments, support procedures, evidence and decision records.

· Ensure production readiness through monitoring, knowledge transfer, support ownership, recovery procedures, lifecycle plans and measurable service objectives.

· Act as a technical authority and escalation point for complex endpoint issues, high-severity vulnerabilities, major changes and transformation initiatives.

· Mentor engineers and coordinate delivery across Security, Architecture, IAM, Network, Cloud, VDI, Service Desk, application teams, vendors and managed-service partners.

REQUIRED QUALIFICATIONS

· Bachelor's degree in computer science, information systems, engineering or a related field, or equivalent practical experience.

· Typically 12 or more years of progressive infrastructure or EUC engineering experience, including ownership of complex enterprise implementations.

· Advanced experience with Microsoft Intune and Configuration Manager/SCCM in co-managed, hybrid or migration environments.

· Strong knowledge of Windows endpoint architecture, provisioning, servicing, policy, security, application deployment and troubleshooting.

· Working knowledge of macOS and mobile management using Jamf and/or Intune MDM/MAM, Apple Business Manager and platform compliance capabilities.

· Experience with Microsoft Entra ID, Active Directory, Group Policy, Conditional Access dependencies, modern authentication, certificates and PKI concepts.

· Hands-on automation experience with PowerShell, Microsoft Graph and REST APIs, plus familiarity with source control and structured release practices.

· Experience with application packaging and deployment technologies such as Win32 applications, MSI and MSIX, including detection, requirements, dependencies and supersedence.

· Knowledge of endpoint security technologies and concepts including Microsoft Defender, BitLocker, LAPS, Windows Hello for Business, application control and attack-surface reduction.

· Experience with IT service management, change control, incident and problem management, configuration management and production support in a regulated enterprise.

PREFERRED EXPERIENCE

· Engineering endpoint services at global scale across multiple regions, business units and device types.

· Windows Autopilot, Windows Autopatch, Company Portal, Cloud Management Gateway, tenant attach, Cloud PC or virtual desktop integration.

· Browser governance, Chrome Enterprise Core, enterprise site lists, extension controls and legacy-browser dependency remediation.

· Application packaging automation, test automation, digital employee experience, proactive remediation or self-healing workflows.

· ServiceNow, Power BI, Azure DevOps or comparable workflow, backlog, reporting and portfolio-management platforms.

· Cryptographic inventory, certificate and trust dependency management, crypto-agility or post-quantum readiness planning.

· Relevant Microsoft, Azure, security, Apple/Jamf or ITIL certifications.

PROFESSIONAL COMPETENCIES

· End-to-end ownership, sound risk judgment and ability to drive work from requirements through stable operational handoff.

· Strong systems thinking with the ability to assess impacts across identity, network, security, applications, support and user experience.

· Disciplined engineering practices including standards, reusable patterns, testing, peer review, documentation and measurable acceptance criteria.

· Clear written and verbal communication with the ability to explain technical decisions, risks and trade-offs to engineers, partners and senior leaders.

· Ability to collaborate across organizational boundaries while maintaining clear accountability, decision rights and delivery commitments.

· Continuous-improvement mindset focused on eliminating recurring issues, automating repetitive work and reducing technical debt.

Working with Us

As a Northern Trust partner, you will be part of a flexible and collaborative work culture, which has a strong history of financial strength and stability. Movement within the organization is encouraged, senior leaders are accessible, and you ca