AVPVP, Endpoint & Device Management Engineer, Technology Group

Location:Singapore

Job Function:Technology Group

Job Type:Permanent

Req ID:17483

Recruiter:Yvonne Loh

GIC is one of the worlds largest sovereign wealth funds. With over 2000 employees across 11 locations around the world we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the worlds industry leaders. As a leading global long-term investor we Work at the Point of Impact for Singapores financial future and the communities we invest in worldwide.

Technology Group
We experiment design and lead a 247 global business where we support core capabilities in asset management trading investment operations and risk management. We deliver secure reliable and integrated solutions and provide insights on new and emerging technologies.

What impact will you make in this role

As an Endpoint and Device Management Engineer within End User Infrastructure Engineering you will own the engineering of the platforms that provision secure patch and manage every device our people work on approximately 5000 Windows endpoints 500 macOS devices and 3000 mobile devices across iOS iPadOS and Android spanning 11 offices and multiple time zones.

You will be accountable for turning our endpoint estate into a modern cloud-managed policy-driven platform: zero-touch from unboxing to productive continuously compliant measurably healthy and hardened to the standards expected of a regulated financial institution. You will engineer by default rather than administer by exception every configuration expressed as code every repeatable task automated every change evidenced and reversible.

What will you do as a AVP/VP Endpoint & Device Management Engineer

Endpoint Platform Engineering

• Own the design build and run engineering of the enterprise endpoint management platforms: Microsoft Intune Entra ID Windows Autopilot MECM/Configuration Manager and Jamf.
• Define and maintain the target-state endpoint architecture across Windows macOS iOS/iPadOS and Android including the co-management and MECM-to-Intune modernisation roadmap.
• Engineer device configuration profiles security baselines and compliance policies as reusable version-controlled configuration-as-code artefacts.
• Manage the full device lifecycle: enrolment provisioning configuration certificate and identity binding refresh re-deployment wipe and retirement.
• Maintain platform currency service releases feature ring strategy OS feature updates and vendor roadmap adoption with impact assessed ahead of Microsoft and Apple release cycles.

Zero-Touch Provisioning and Device Experience

• Engineer and continuously improve zero-touch provisioning across all platforms: Autopilot (including pre-provisioning and device preparation) Apple Business Manager with Jamf and Android Enterprise / Apple User Enrolment for mobile.
• Reduce time-to-productive for new joiners refreshes and break-fix replacements and eliminate manual build steps from the provisioning path.
• Engineer the Windows and macOS standard operating environments including baseline applications localisation drivers and firmware and profile and data migration.

Application Packaging and Deployment

• Own application packaging sequencing and deployment across Windows (Win32/MSI/MSIX) and macOS (PKG/DMG) including detection rules requirement rules dependency logic and supersedence.
• Design ring-based progressively staged deployments with automated health validation and defined rollback covering both business applications and OS feature updates.
• Partner with application owners and vendors on packaging standards compatibility testing and end-of-life remediation maintaining an evergreen application estate.

Patch and Vulnerability Remediation

• Engineer the patch management service across Windows macOS mobile and third-party applications with clear SLAs for critical and high-severity vulnerabilities.
• Partner with Information Security and Technology Risk to translate vulnerability findings into packaged tested tracked remediation and drive down mean time to remediate.
• Build reporting that evidences patch compliance and remediation posture to management internal audit and regulators.

Device Compliance Identity and Conditional Access

• Engineer device compliance policies and their integration with Entra ID Conditional Access ensuring only healthy managed trusted devices reach corporate data and applications.
• Implement and maintain modern authentication and passwordless capabilities on the endpoint including Windows Hello for Business certificate-based authentication and device-bound credentials.
• Manage the endpoint side of data protection: app protection policies MAM for unmanaged and BYOD scenarios and controls over corporate data on mobile devices.

Endpoint Security Engineering

• Engineer the deployment configuration and health of endpoint security tooling in partnership with Information Security: EDR DLP disk encryption (BitLocker FileVault) attack surface reduction and application control.
• Maintain security baselines against recognised benchmarks (CIS Microsoft Security Baselines Apple platform guidance) with drift detection and automated remediation.
• Own endpoint hardening initiatives and support audit penetration test and regulatory findings through to closure.

Telemetry Analytics and Proactive Remediation

• Establish unified endpoint telemetry using Nexthink Intune Endpoint Analytics and platform data to measure device health boot and logon performance application stability and crash and reliability trends.
• Turn telemetry into action: build proactive detection and machine-led remediation for recurring endpoint issues before they generate tickets.
• Define and report the endpoint health scorecard compliance patch currency provisioning success rate device reliability and digital employee experience.

Automation and Engineering Practice

• Work automation-first: PowerShell Microsoft Graph API and Python (Terraform where applicable) to eliminate manual effort across provisioning policy packaging reporting and remediation.
• Maintain automation assets in source control with peer review testing and CI/CD-style release pipelines; write runbooks as code that are safe auditable and reversible.
• Contribute to engineering standards across End User Infrastructure including code quality secrets handling and least-privilege service principal design.

Key Technologies & Domains

Endpoint & Device Management

• Microsoft Intune / Endpoint Manager
• MECM / Configuration Manager (including co-management)
• Windows Autopilot Apple Business Manager Android Enterprise
• Jamf Pro
• Windows 11 macOS iOS iPadOS Android

Identity & Access

• Entra ID (Azure AD) Conditional Access device identity and compliance
• Active Directory Group Policy hybrid join and cloud-native join models
• Certificate services SCEP/PKCS Windows Hello for Business

Endpoint Security

• EDR platforms (e.g. Microsoft Defender for Endpoint CrowdStrike)
• DLP disk encryption (BitLocker FileVault) application control ASR
• Vulnerability management and remediation tooling
• Security baselines and benchmarks (CIS Microsoft Apple)

Experience & Telemetry

• Nexthink or equivalent digital experience monitoring
• Intune Endpoint Analytics Microsoft 365 Apps health and update telemetry
• Log Analytics / Kusto for endpoint reporting

Automation & Engineering

• PowerShell (advanced)
• Microsoft Graph API and REST API integration
• Python; Terraform and Infrastructure-as-Code concepts
• Git-based source control and CI/CD pipelines (e.g. Azure DevOps)
• Application packaging: Win32 MSI MSIX PKG PSADT Intune Win32 content prep

What makes you a successful candidate

Experience

• 12 years of hands-on engineering experience in endpoint device or digital workplace infrastructure at enterprise scale.
• Demonstrated ownership of a multi-platform fleet of comparable size and geographic spread including Windows macOS and mobile.
• Experience operating in a regulated environment financial services or another sector with equivalent audit change and control obligations.
• Track record of delivering a modernisation programme (for example MECM to Intune imaging to Autopilot or on-premises to cloud-native management) in a live production estate.

Technical & Domain Expertise

• Deep hands-on expertise with Microsoft Intune and Entra ID including policy design compliance Conditional Access and Autopilot.
• Strong working knowledge of MECM/Configuration Manager and co-management with a clear point of view on where workloads should sit.
• Practical macOS management experience with Jamf Pro and mobile management across iOS/iPadOS and Android Enterprise.
• Strong application packaging and deployment capability across Windows and macOS including detection logic dependencies and supersedence.
• Solid grounding in endpoint security engineering EDR DLP encryption hardening and vulnerability remediation and comfort partnering with Information Security as a peer.
• Advanced PowerShell and Microsoft Graph API skills with working knowledge of Python; familiarity with Terraform and Infrastructure-as-Code practice is an advantage.
• Experience using digital experience monitoring (Nexthink or similar) to drive proactive remediation rather than passive reporting.
• Relevant certifications are valued but not required (e.g. Microsoft MD-102/SC-300 Jamf Certified Admin or Expert).

Work at the Point of Impact
We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious agile and diverse teams - be empowered to push boundaries and pursue innovative ideas share your views and be heard. Be anchored on our PRIME Values: Prudence Respect Integrity Merit and Excellence which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

GIC is a Great Place to Work

At GIC our offices are vibrant hubs for ideation professional growth and interpersonal connection. At the same time we believe that flexibility allows us to do our best work and be our best selves. Thus our teams come into the office four days per week to harness the benefits of in-person collaboration but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise. This role will be in our Tampines Office.

GIC is an equal opportunity employer
As an employer we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Technology Group here:
Experience:

Exec