L2 Intune SME

EssilorLuxottica is a fully integrated player and global leader in the eyecare and eyewear industry, with operations across design, manufacture and distribution of ophthalmic lenses, frames and sunglasses. The organization supports a worldwide technology environment that requires secure, reliable, and scalable endpoint management services.

POSITION PURPOSE

The Essilor Shared Services Philippines Inc. ESSPI is looking for a Modern Desktop Intune SME to provide technical ownership, operations leadership and governance for Microsoft Intune and endpoint management services across global regions.

As part of the Infrastructure Shared Services Center, this role will represent Employee Services towards Business Units, Local IT, Service Desk, Security, Infrastructure, project teams and vendors. The role ensures the stable administration, support, lifecycle management and continuous improvement of Microsoft Intune, Windows Autopilot, endpoint security, device compliance, application deployment and modern desktop management services.

The position serves as the main SME and escalation point for Intune-related operations, ensuring endpoint services are delivered with strong security posture, SLA discipline, audit readiness and user experience alignment.

PRIMARY RESPONSIBILITIES

• SME Microsoft Intune administration, governance and day-to-day endpoint management operations for global standard workstations and supported mobile devices.
• Serve as SME and escalation point for Intune, Windows Autopilot, endpoint compliance, configuration profiles, application packaging, software deployment, BitLocker, LAPS, Conditional Access and Microsoft Defender for Endpoint integration.
• SME L2/L3 technical troubleshooting for Intune enrollment, policy conflict, device compliance, Autopilot provisioning, application deployment, remediation scripts and endpoint security issues.
• Review, approve and maintain Intune technical standards, configuration baselines, implementation plans, support handover packages and operational documentation.
• Coordinate Intune operational support with Service Desk, Local IT, Security, Infrastructure, regional stakeholders and Microsoft support during incidents, changes and project activities.
• Drive continuous improvement, automation, reporting and proactive monitoring for endpoint health, compliance, deployment success and recurring issues.
• Ensure adherence to ITIL processes for incidents, requests, problems, changes and major incident support related to endpoint management services.
• Support knowledge transfer, coaching and skills development for L1/L2/L3 resources assigned to Modern Desktop and Intune operations.

MAIN INTUNE ROLE AND SCOPE

Capability Area - Main Role

Typical Deliverables

• Endpoint Governance
• Own Intune standards, baselines, naming conventions, scope tags and operational guardrails.
• Documented standards, governance review, audit-ready controls
• Device Compliance
• Design, maintain and troubleshoot compliance policies aligned to security requirements.
• Compliance dashboards, remediation plan, noncompliance RCA
• Configuration Profiles
• Manage Windows configuration profiles, security baselines and policy conflict resolution.
• Approved profiles, change records, rollback plans
• Autopilot & Enrollment
• Support Autopilot provisioning, Entra-joined onboarding, enrollment failures and device lifecycle.
• Enrollment tracker, deployment guide, technical escalation notes
• Applications
• Coordinate app packaging, assignment groups, deployment monitoring and failure remediation.
• App deployment matrix, packaging SOP, deployment health report
• Endpoint Security
• Support BitLocker, LAPS, Defender for Endpoint, attack surface reduction and Conditional Access alignment.
• Security remediation actions, exception tracking, compliance evidence
• RBAC & Least Privilege
• Support role-based access alignment with Intune built-in roles, custom roles, scope groups and PIM controls.
• Access matrix, review inputs, least-privilege recommendations
• Reporting & Automation
• Build repeatable reporting and scripts to reduce manual work and improve operational visibility.
• PowerShell scripts, Power BI/Excel reports, KPI updates

INTUNE ROLE-BASED ACCESS ALIGNMENT

The role should support a least-privilege operating model. Daily administration should use Intune built-in or custom role assignments instead of broad privileged access whenever possible. The role will help validate which RBAC role is appropriate for each support activity and ensure access is aligned to approved scope groups, scope tags and PIM requirements.

• Endpoint Security Manager: for security and compliance features such as security baselines, device compliance, Conditional Access and Defender-related endpoint controls.
• Policy and Profile Manager: for compliance policy, configuration profiles, enrollment-related profiles and security baselines.
• Application Manager: for managed app, mobile app and application deployment administration.
• Help Desk Operator: for remote device tasks, user/device support actions and limited policy/application assignments.
• Read Only Operator: for viewing user, device, enrollment, configuration and application information without changes.
• Intune Role Administrator: for custom Intune roles and built-in Intune role assignments, limited to authorized administrators.

OPERATIONS & SERVICE DELIVERY

• Maintain SLA and KPI compliance for Intune-related incidents, requests and changes.
• Monitor service health, device compliance status, deployment success rates and recurring failures.
• SMERCA activities for recurring Intune issues and major endpoint-impacting incidents.
• Manage operational handover between shifts and ensure complete internal notes, next actions and ownership are documented.
• Coordinate escalations with Microsoft, vendors, Security, Infrastructure, Local IT and regional support teams.

SECURITY & COMPLIANCE

• Implement Microsoft endpoint security best practices in coordination with Security and Enterprise Architecture teams.
• Support compliance initiatives, audit evidence gathering and endpoint governance reviews.
• Manage and troubleshoot Conditional Access impacts connected to device compliance and Intune enrollment.
• Coordinate vulnerability remediation activities through configuration profiles, remediation scripts, Defender actions and application updates.
• Promote Zero Trust principles, least privilege access and secure administrative practices.

AUTOMATION & PROCESS IMPROVEMENT

• Develop and maintain PowerShell scripts for reporting, remediation, deployment validation and operational efficiency.
• Identify recurring Intune issues and convert them into automation, SOP improvements or knowledge articles.
• Create dashboards and management reporting for Intune enrollment, compliance, Windows upgrade readiness, deployment status and endpoint health.
• Maintain SOPs, RACI, checklists and escalation guides for Modern Desktop and Intune support activities.

PROJECT DELIVERY

• SME or support endpoint-related projects including Intune enrollment expansion, Windows Autopilot, Windows 11 readiness, application packaging, device compliance improvement and security hardening.
• Coordinate migrations, tenant enhancements and deployment waves with Local IT, project managers, Security and external vendors.
• Represent Employee Services in technical workshops, governance reviews, change advisory discussions and project handover sessions.

BEHAVIOR ABILITIES

• 5-7 years of IT Infrastructure, End User Computing or Modern Workplace experience.
• 5+ years supporting Microsoft 365 or endpoint technologies.
• 3+ years managing Microsoft Intune in an enterprise environment.
• Strong leadership, ownership, communication and stakeholder management skills.
• Ability to analyze incidents, identify patterns, synthesize technical findings and drive corrective actions.
• Customer-service oriented, organized, rigorous and able to work with people within and outside IT.
• Comfortable supporting a global, multicultural and 24x7 operational environment.
• Willingness to coach team members, build documentation and support upskilling of L1/L2/L3 resources.

TECHNICAL ENVIRONMENT

• Microsoft Intune
• Windows Autopilot
• Microsoft Entra ID (Azure AD)
• Conditional Access
• Device Compliance Policies
• Configuration Profiles
• Security Baselines
• Endpoint Privilege Management
• BitLocker
• Windows LAPS
• Microsoft Defender for Endpoint
• Mobile Device Management (MDM)
• Mobile Application Management (MAM)
• Application Packaging & Deployment
• PowerShell Scripting
• Microsoft Graph / reporting concepts
• Windows 10/11 endpoint lifecycle
• ITIL Incident, Problem and Change Management

PREFERRED CERTIFICATIONS

• Microsoft Certified: Endpoint Administrator Associate
• Microsoft Certified: Enterprise Administrator Expert
• Microsoft Certified: Security Administrator Associate
• Microsoft Certified: Azure Administrator Associate
• Microsoft Certified: Identity and Access Administrator Associate
• ITIL Foundation v4