Workplace Engineer Subject Matter Expert

The Eindhoven University of Technology (TU/e) is within scope of the NIS2 directive and has strategically committed to achieving ISO27001 compliance maturity in the coming years. TU/e has identified four strategic focus areas within its Digital Safety Program. The Digital Safety Program aims to significantly strengthen the university’s cyber resilience, governance, identity & data security, endpoint security and overall control framework, while maintaining the open and collaborative nature of an academic institution. To support this transformation, TU/e is looking for a highly experienced Workplace Engineer Subject Matter Expert to technically design, build, test and support the rollout of the Secure Modern Workplace initiative within the scope of the Digital Safety Program. 1.3.2 Secure Modern Workplace The Secure Modern Workplace project will define, design and implement a future-ready workplace model for TU/e. The project must balance strong central security standards with the specific needs of faculties, researchers, local IT-teams and specialized academic environments. A key objective is to co-create new workplace types with the faculties, including the standard secure workplace, research workplace, Linux workplace, macOS workplace and BYOD workplace. The project also includes the rollout of Mobile Device Management and the use of Microsoft capabilities such as Intune, Autopilot, Company Portal, Entra ID, Conditional Access, device compliance and Microsoft Defender for Endpoint. 1.3.3 Role Profile

• Workplace Engineer Subject Matter Expert The Workplace Engineer SME is responsible for translating the workplace solution design into working technical configurations, builds and rollout-ready workplace types. The role works closely with the Project Manager Secure Modern Workplace, the Program Architect, LIS workplace management, security specialists, local IT and faculty representatives. The objective is to create controlled, automated and service-oriented workplace building blocks that reduce unmanaged risk, improve user experience, enable MDM adoption and lower operational support effort through standardization, automation and clear support boundaries. 1.3.4 Key responsibilities include

• Translate the approved solution design and architecture principles into technical workplace configurations and reusable service building blocks.
• Design, build and validate the standard secure workplace, research workplace, Linux workplace, macOS workplace and BYOD workplace concepts.
• Configure and support the rollout of MDM and Microsoft endpoint management capabilities, including Intune, Autopilot, Company Portal, Entra ID, Conditional Access, compliance policies and Microsoft Defender for Endpoint.
• Work with faculties, researchers and local IT teams to validate technical requirements, test workplace types and adapt implementation options where justified.
• Support pilots and rollout waves, including technical troubleshooting, acceptance testing, user migration support and feedback processing.
• Document configuration choices, support boundaries, exception logic and operational procedures for handover to the beheer/support teams.
• Provide knowledge transfer, coaching and practical training to internal engineers and operational teams to enable sustainable in-house ownership.
• Ensure continuous alignment with the Project Manager Secure Modern Workplace, Program Architect, security baselines, IAM, application packaging and service management processes. The ideal candidate has extensive hands-on experience as a senior workplace engineer or endpoint management specialist in complex modern workplace, MDM, cybersecurity and service transition environments. The role requires the ability to build and configure technical solutions, while also communicating clearly with architects, project management, faculties, researchers and support teams. Datum Referentie 1.3.5 The department and organization TU/e consists of various departments and faculties where education and research are conducted, supported by several central services. The candidate will work within the Digital Safety Program, primarily with LIS workplace management, end-user services, architecture, security operations, service management and local IT teams. A substantial part of the assignment is to work directly with the Project Manager Secure Modern Workplace, the Program Architect, faculty stakeholders, researchers and local IT teams to translate requirements into technical workplace builds, validate implementation choices and support a smooth transition into the new Secure Modern Workplace support model. The candidate reports to the Project Manager Secure Modern Workplace. 1.3.6 Description of the work and Key Deliverables 1. Approved Technical Work Plan and Build Backlog A clear technical delivery plan covering build activities, configuration work, testing, dependencies, risks, rollout support and handover milestones, aligned with the project plan. 2. Solution Design Translation A practical translation of the solution design and architecture principles into technical workplace configurations, policies, profiles, baselines and implementation choices. 3. Standard Secure Workplace Build A configured and validated standard secure workplace, including device management, security baseline, user experience, application access, Autopilot provisioning and operational support model. 4. Research Workplace Build A configured and validated research workplace, including device management, security baseline, user experience, application access, Autopilot provisioning and operational support model. 5. Linux and MacOS Workplace Build A configured and validated Linux & MacOs, including device management, security baseline, user experience, application access, Autopilot provisioning and operational support model. 6. BYOD and MDM Configuration A technical design and configuration approach for BYOD access, mobile device management, device compliance, enrolment, remote wipe, application access and privacy-sensitive operating principles. 7. Microsoft Endpoint Management Configuration Configured use of Intune, Autopilot, Company Portal, Entra ID, Conditional Access, compliance policies and Microsoft Defender for Endpoint within the target workplace model. 8. Application Deployment and Packaging Support Technical support for application packaging, scripting, Company Portal publication and light rationalisation of the application landscape. 9. Security Baseline and Compliance Implementation Implementation of minimum management and security baselines covering device compliance, local admin approach, patching, endpoint protection, vulnerability visibility, logging and monitoring. 10. IAM and Conditional Access Technical Alignment Technical alignment with IAM, device identity, user identity, RBAC/ABAC principles, conditional access and privileged access requirements. 11. Pilot Build, Test and Evaluation A completed pilot build with selected faculties or user groups, including test results, lessons learned, refined configurations and recommendations for wider rollout. 12. Rollout Support for Workplace Types Datum Referentie Hands-on technical support during rollout waves, including user migration support, troubleshooting, issue resolution and stabilization activities. 13. Service Building Blocks and Technical Documentation Technical input for service building blocks, service catalogue descriptions, configuration standards, support levels, responsibilities and operational procedures. 14. Operational Handover and In-Service Transition A structured handover to beheer/support teams, including documentation, runbooks, known issues, monitoring/reporting routines, support boundaries and acceptance criteria. 15. Knowledge Transfer to Internal Teams Active knowledge transfer and practical training for internal engineers, support teams and workplace management staff, enabling sustainable operation after the assignment. 16. Architecture and Program Alignment Continuous alignment with the Program Architect, Project Manager Secure Modern Workplace and wider Digital Safety dependencies such as IAM, security operations, application packaging and service management.