Overview Location: Hybrid in Pittsburgh., PA (3 days onsite, 2 days remote) Job Type: Full Time / Contract Work Authorization: No Sponsorship The A.C.Coy company has an immediate opening for a Microsoft Windows Client Engineer. Ideal candidates must have 3- 5 years of experience engineering and administering Microsoft Windows endpoints in an enterprise environment. Hands-on experience with Microsoft Intune and SCCM/Configuration Manager including application packaging and deployment is also required. Responsibilities Windows Client Engineer to manage and modernize the Windows endpoint estate through Microsoft Intune and SCCM (Configuration Manager), with a primary focus on driving down vulnerability risk. This is a hands-on engineering role: partner closely with the security team to review findings from Tenable, translate them into deployable fixes, and build the packages, scripts, and configuration baselines that remediate them at scale. • Review outstanding vulnerabilities identified by Tenable Nessus / Tenable Security Center and own the endpoint-side remediation workflow from finding to closure • Build, test, and deploy remediation packages and solutions using Intune and SCCM — application updates, patches, registry and configuration changes, and scripted fixes • Author and maintain remediation scripts (PowerShell), including detection and remediation logic for Intune proactive remediations and SCCM configuration items • Package and deploy third-party application updates that fall outside standard Microsoft patching (e.g., via Win32 apps in Intune, application deployments in SCCM, or a patching tool like PatchMyPC) • Manage Windows Update policy through Windows Update for Business / WSUS / SCCM software update groups, and ensure patch compliance reporting is accurate • Partner with the security/vulnerability management team to triage findings, validate that deployed fixes actually clear the vulnerability, and provide feedback on false positives • Track remediation progress and report on compliance, patch coverage, and outstanding risk against SLAs • Maintain configuration baselines and security hardening (e.g., CIS/DISA STIG alignment) across the Windows client fleet • Support co-management, device onboarding, compliance policies, and conditional access as part of the broader Intune/SCCM environment • Document remediation procedures and contribute to a repeatable, well-tested deployment process to avoid breaking production Qualifications Education: • Bachelor's degree or equivalent experience Certifications: • Microsoft MD - 102, SC - 200, or CompTIA Security+ - Preferred Responsibilities: • Experience engineering and administering Windows endpoints in an enterprise environment - 3-5 years • Hands-on experience with both Microsoft Intune and SCCM/Configuration Manager, including application packaging and deployment • Strong PowerShell scripting skills for automation, detection, and remediation • Experience with Windows patch management (Windows Update for Business, WSUS, or SCCM software updates) • Familiarity with vulnerability management concepts and tooling — Tenable experience strongly preferred; comparable tools (Qualys, Rapid7) also relevant • Understanding of CVEs, CVSS scoring, and how vulnerability findings map to real remediation actions • Solid grasp of Windows OS internals, Active Directory, Group Policy, and Entra ID (Azure AD) • Ability to test changes carefully and roll out fixes without disrupting end users • Experience with application packaging tools (PSADT, PatchMyPC) and MSI/MSIX - Preferred • Exposure to Microsoft Defender for Endpoint and its vulnerability management (TVM) integration - Preferred • Knowledge of security hardening frameworks (CIS Benchmarks, DISA STIGs) - Preferred