Senior Engineer - Endpoint Experience

Job Description

Overview

We’re looking for a Senior Engineer - Endpoint Experience to join the Endpoint Experience team we are building within Workplace Experience, part of Digital Foundation. The team owns how ASOS manages its estate of employee devices (laptops, workstations, phones, and tablets): how security policy reaches every device, how changes are proven safe before they roll out, how applications are packaged and offered to ASOSers, how we measure whether the service works, and which devices we buy in the first place.

ASOS is investing in endpoint engineering as an in-house capability. We want raising patch compliance, rolling out new tools to ASOSers (for example AI tooling for every employee), and evolving our device platforms to be routine engineering work we control end to end, rather than projects with long lead times. You will build the foundations that make device management a product with version control, automated testing, staged rollouts, and clear metrics, and you will continuously evaluate the major device vendors and management platforms to drive the evolution of our estate.

This is a hands-on senior role. You will be one of the first engineers in a team we are growing, set the technical bar for those who join after you, do a large share of the building yourself, and act as the technical counterpart to Cyber Security, IT Support, and Procurement. You will own the technical approach for our device management platforms, today Intune for Windows and Jamf for Apple devices, and for our security baselines and endpoint automation.

The role reports to the Engineering Manager for Endpoint Experience and works closely with Cyber Security, Developer Productivity, IT Support, Finance, and Procurement. The team is not a first-line support function: first response and device handover stay with IT Support, and servers are owned by Workplace Infrastructure (on-premises) and Developer Infrastructure (cloud).

Purpose of the Role

The Senior Engineer - Endpoint Experience exists to make the ASOS device estate secure by default, predictably reliable, and measurably good to use. Today, too much of what happens to a device between purchase and retirement is manual, slow to change, and hard to see. The team’s job is to make it engineered: every change versioned and reviewed, proven safe on a representative cohort before it reaches everyone, and visible in metrics that tell us whether employees are better off.

Key Responsibilities

Technical Leadership

• Set the engineering standards and technical approach for the team, shape the roadmap with the Engineering Manager, and make and document clear trade-offs between security, employee experience, cost, and simplicity

• Mentor engineers, review their work, and set the standard for AI-assisted ways of working in the team

Configuration & Compliance

• Design and build the pipeline that takes device configuration and the security policy authored by Cyber Security as versioned code, validates it, and deploys it through Intune and Jamf, so every change is traceable to a reviewed source and drift is detected

• Own endpoint security baselines and patch compliance as an automated, continuously tuned standard rather than a periodic project

• Engineer joiners-movers-leavers automation for devices, from a compliant device on day one to recovery and wipe without manual steps

Safe Change

• Design and build the test harness that validates policy, OS, application, and configuration changes against representative device cohorts before fleet-wide rollout, with staged rings, health gates, and automated rollback, so it becomes the single path to production for device changes

Measurement & Continuous Improvement

• Define and publish the metrics that describe service health and employee experience (satisfaction, device health, compliance, time to provision, change failure rate, support demand), combine them with regular employee feedback, and turn them into a prioritised improvement backlog

• Define the endpoint analytics strategy, establishing the measures, telemetry and service health indicators used to assess compliance, employee experience and platform effectiveness.

The ASOS App Store

• Own the self-service application catalogue, the packaging standards and release process, and the lifecycle of applications on the estate, so that every application reaches devices through the same tested path as policy and stays current

• Partner with Developer Productivity to define and maintain the curated developer toolset (IDEs, runtimes, CLIs, AI coding tools, security tooling) so that new engineers are productive on day one

• Work with Cyber Security on allow-listing and with FinOps and Procurement on licence entitlement, keeping packaging and deployment in the team

Device Estate Governance

• Own device standards per employee persona, run structured evaluations of hardware, vendors, and management platforms against fit for purpose and total cost of ownership, and make evidence-based recommendations to Procurement and Finance

• Define the lifecycle and refresh approach for the estate, balancing cost, sustainability, security posture, and employee experience

• Define how applications, configurations and device capabilities are mapped to employee personas, ensuring provisioning remains secure, supportable and automated.

What Success Looks Like

• Patch compliance at the required level, sustained by automation, and no change reaching the fleet outside the versioned pipeline and test harness

• A measurable reduction in change-related incidents, and a trusted set of service metrics the team visibly uses to decide what to improve

• Employees self-serving applications without tickets, and new engineers able to build and ship on day one

• Device purchasing backed by structured evaluations and cost data rather than vendor preference

• Engineering standards and a technical foundation that let the team grow without rework

Qualifications

About You

You have managed a modern device estate at scale and are frustrated by how much of that work is still done by hand. You think of a fleet of devices as a distributed system that deserves the same version control, testing, and observability as any production service. AI assistants are a normal part of how you engineer, and you use them wherever they get you to a goal faster or better while keeping your judgement about what you ship.

You likely bring:

• Deep hands-on experience with Microsoft Intune and Jamf Pro, managing Windows and macOS at scale, including their APIs (Microsoft Graph, Jamf API)

• Experience treating device configuration as code (version control, code review, CI pipelines), or a strong platform engineering background you want to bring to this domain

• Strong scripting and automation skills in PowerShell, Python, or shell

• Experience packaging and deploying applications at scale and running a self-service catalogue, and designing staged rollout and rollback strategies for changes that affect many users

• Working knowledge of endpoint security controls, compliance frameworks, identity and conditional access, and how they translate into device policy

• Fluency with AI-assisted ways of working, and the judgement to know when they help and when they do not

• The ability to explain trade-offs to security, finance, and procurement stakeholders, and to disagree constructively

Why This Role Matters

Every ASOS employee depends on devices that are secure, reliable, and stay out of their way. How we manage that estate determines how quickly we can respond to a new threat, how much time IT Support spends firefighting, and how much we spend on hardware. This role builds the foundations that let us move quickly on all three at once, with evidence rather than guesswork.

…