Windows Endpoint Administrator

Summary

The Windows Systems Administrator is a technical lead responsible for the architecture, security, and continuous optimization of the district’s Windows endpoint infrastructure. Reporting to the Director of Innovative Technology, this role serves as the primary engineer for the district’s Microsoft Endpoint Configuration Manager (MECM/SCCM) environment. The Administrator ensures enterprise-wide stability by designing robust patching workflows, managing complex software deployments, and maintaining the overall health of the Windows ecosystem.

Essential Duties and Responsibilities

Listed below are the essential functions required to achieve the purpose of this job. The functions are not an exhaustive list of the duties and responsibilities of this role. Time percentages are estimates and may vary by location and/or assignment.

Configuration & Infrastructure Maintenance (40%)

• Lead infrastructure engineering for MECM/SCCM by designing, implementing, and scaling the hierarchy to support district-wide workstation services.
• Drive system automation by developing and maintaining advanced PowerShell scripts to streamline administration, automate configuration management, and remediate vulnerabilities.
• Own vulnerability management and patch compliance by orchestrating Windows OS and third-party patching to meet cybersecurity standards and achieve full compliance.
• Establish and enforce configuration, compliance, and escalation support by hardening systems with GPOs/MECM compliance baselines and serving as the subject matter expert for advanced troubleshooting (kernel, deployment failures, registry-level issues).

Patching & Application Deployment (35%)

• Improve and manage the patching lifecycle for Windows Servers and workstations, including maintaining the patching process/cycle and actively verifying and applying security updates.
• Design, build, and execute automated OS deployment (OSD) imaging sequences to support district-wide workstation provisioning and reimaging.
• Use Structured Query Language (SQL) and database querying to support reporting, troubleshooting, automation, and operational decision-making.
• Manage application packaging and software deployment pipelines to deliver applications efficiently with minimal disruption to end users.

Documentation & Project Support (15%)

• Develop and maintain documentation related to project, operational, incident, and problem management.
• Develop and maintain documentation for MECM/SCCM procedures and system configurations.
• Analyze and document business processes to facilitate the evaluation of software updates, changes, and user enhancement requests.
• Assist with the Enterprise Product Evaluation (EPE) for new hardware introduction and software integrations.

Service & Communication (5%)

• Manage incidents, service requests, and escalations by logging requests/support calls, troubleshooting, and escalating unresolved issues to vendors as needed.
• Collaborate and communicate with end-users, teammates, and internal/external customers to understand district needs, provide solutions, and gather feedback.
• Coordinate and oversee monthly downtime maintenance to ensure planned work is executed smoothly, communicated clearly, and documented appropriately.
• Partner with stakeholders to align process improvements, upgrades, and daily support work with district goals—especially student growth and achievement.

Perform other duties as assigned (5%)

• Perform other duties as assigned.

Education and Training

• Bachelor’s degree in Computer Science, Information Technology, or a related field (or equivalent professional experience).

Experience

• Five years of experience in Windows Systems Administration, with three years specifically focused on MECM (SCCM) architecture and automated patch management.
• Required experience includes two years of administering Microsoft Intune and one year of experience in Information Technology Infrastructure Library (ITIL) Change Management.
• Expertise needed in Advanced knowledge of PowerShell and scripting, and experience managing on-prem Active Directory, Azure Active Directory, and Azure AD Connect.
• Scripting Proficiency: Advanced experience using PowerShell to manage Active Directory objects, manipulate the registry, and automate software deployments.
• Networking Knowledge: Solid understanding of TCP/IP, DNS, DHCP, and PXE boot processes as they relate to imaging and endpoint communication.

Skills, Knowledge, and Competencies

• Ability to promote and follow district policies and building and department procedures.
• Ability to communicate, interact, and work effectively and cooperatively with people from diverse backgrounds.
• bility to recognize the importance of safety in the workplace, follow safety rules, practice safe work habits, utilize appropriate safety equipment, and report unsafe conditions to the appropriate administrator.
• Strong oral and written communication skills. Strong Analytical, Multitasking, Organizational, and Time management skills.
• Advanced knowledge of PowerShell and scripting (development and optimization).
• Knowledge of technical change management best practices.
• Solid background operating user, server, device management systems, network monitoring applications, and operating centralized print management.
• Deep knowledge and understanding of datacenter operations.
• Strong customer service orientation and ability to continuously learn as the product evolves.
• Ability to quickly identify client issues and conduct in-depth diagnostics on Microsoft Intune products and the Microsoft Endpoint Configuration Manager program.
• Experience with Active Directory Group Policy Object (GPO), including configuration and security for Windows OS.
• Experience in configuring and managing Multifactor Authentication (MFA) and conditional access policies, managing Group Policy for an enterprise environment.
• Versed in the management of System Center Configuration Manager (SCCM/MECM), including image creation and deployment of Windows OS, configuring, deploying, and troubleshooting Intune policies.

Certificates, Licenses & Registrations

• Intune/MECM Certification.
• Microsoft 365 Modern Desktop Administrator Associate.
• Microsoft 365 Certified Enterprise Administrator expert certification or MCSE certification.
• Network+ and Security+ certification.
• ITIL® V3 or ITIL® V4 certifications.
• Microsoft Certified Solutions Expert (MCSE) / Microsoft Certified Solutions Associate (MCSA), or other relevant certifications.
• Must possess a valid Colorado driver's license.
• A driving record must meet the standards of the district's insurance policy.
• Criminal background check and fingerprinting required for hire.

Preferred Qualifications

• Education, training, experience, skills, knowledge, licenses, certifications, endorsements, designations, and other qualifications relevant to the position that are strongly preferred but not required at hire.
• Oral and written fluency in a second language may be preferred based on the building assignment.
• Supervision/Technical Responsibility
• Responsible for supervising the behavior and well-being of students as assigned: The administrator may be asked to supervise student workers or AFS staff.
• No supervisory responsibilities: The administrator assists with coordinating district-level projects with other technical staff and the Director. The role conducts cross-training for various groups, including District Support Technicians, Service Desk, and Network/System Administrators. The position also serves as a technical resource for district staff.

Budget and Resource Responsibility

• No budget or resource responsibilities: The position has no budgetary responsibilities.
• Responsible for recommending supplies or resources: The administrator assists with the Enterprise Product Evaluation (EPE) for new hardware introductions and software integrations.
• Physical Demands, Mental Demands, and Work Environment
• The demands described below are representative of those an employee must meet to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Physical Demands

• Regularly: The employee is regularly required to use their hands to finger, handle, or feel, reach with hands and arms, and talk or hear.
• Frequently: The employee is frequently required to sit.
• Occasionally: The employee is occasionally required to stand, walk, stoop, kneel, crouch, or crawl, and smell. The employee must occasionally lift and/or move up to 50 pounds.
• Specific vision abilities include close vision, distance vision, color vision, peripheral vision, depth perception, and the ability to adjust focus.

Work Environment

• Regularly: work indoors.
• Occasionally: The employee is occasionally exposed to moving mechanical parts, outdoor weather conditions, the risk of electrical shock, and the risk of radiation.
• Noise Level: moderate.

Mental Functions

• Regularly: The employee is regularly required to analyze, compute, synthesize, evaluate, and use interpersonal skills.
• Frequently: The employee is frequently required to compare, communicate, coordinate, compile, and negotiate.
• Occasionally: The employee is occasionally required to copy and instruct.