Security and Systems Administrator

About Stratus

Stratus® is an integrated, multi-disciplinary engineering, architecture, interior design, and consulting firm. Consistently ranking among the Top 500 Design Firms in Engineering News-Record, the firm offers a deep bench of industry experts through a highly collaborative approach, delivering innovative solutions across the full project lifecycle. Operating coast to coast, Stratus® serves clients nationwide while maintaining a strategic commitment to supporting high-growth economies and building vibrant communities that foster the professional growth of its team. Serving public- and private-sector clients, the firm is dedicated to delivering the highest-quality service wherever projects take shape. Across the Civic, Commercial, Industrial, Transportation, Education, Water Resources, and Government sectors, we bring precision, insight, and purpose to every project, from targeted renovations to large-scale infrastructure. Stratus® designs spaces, systems, and solutions that perform, endure, and make an impact, delivering on our promise of Better Plans. Better Places.

The Role

The Security Systems Administrator is responsible for the administration, security, and lifecycle management of Stratus's enterprise endpoint environment, with Microsoft Intune serving as the primary platform for device configuration, provisioning, application deployment, patching, compliance, and endpoint security controls. Working closely with the Director of Cyber Security and IT Enterprise Initiatives, this role independently drives endpoint and cybersecurity initiatives, implements and validates security controls, supports audits and investigations, and establishes scalable technology standards across Stratus's offices, remote workforce, and acquired companies.

Responsibilities

• Serve as the primary administrator for Microsoft Intune, managing configuration profiles, compliance policies, security baselines, enrollment restrictions, role-based access, and other endpoint management controls.
• Manage Windows Autopilot, device enrollment, provisioning, and endpoint lifecycle processes to provide consistent and secure experiences from deployment through retirement.
• Package, test, deploy, update, and retire applications through Intune, including maintaining detection and requirement rules, dependencies, assignment groups, and deployment monitoring.
• Administer Windows Update for Business, including update rings, quality and feature update policies, pilot groups, production deployment schedules, exceptions, and remediation workflows.
• Monitor endpoint enrollment, application deployments, patching, and compliance, troubleshooting failures, policy conflicts, configuration drift, stale devices, and security coverage gaps.
• Develop, implement, and continuously improve endpoint security configurations including Microsoft Defender for Endpoint, encryption, firewall, attack surface reduction, security baselines, and compliance policies.
• Support Microsoft Entra ID endpoint and identity controls, including device identity, Conditional Access, device registration and join, and MFA remediation.
• Translate cybersecurity, business, regulatory, and framework requirements into scalable technical controls, implementation plans, testing criteria, and operating procedures.
• Support cybersecurity assessments, audits, evidence collection, control testing, compliance validation, risk remediation, and security investigations or incident response.
• Serve as a technical contributor during security incidents, assisting with scoping, containment, root-cause analysis, recovery validation, and post-incident remediation.
• Support the integration of acquired companies by onboarding users and devices into Stratus's endpoint environment, identifying security and compliance gaps, and standardizing applications, configurations, and security controls.
• Use PowerShell to automate endpoint administration, application deployments, reporting, compliance monitoring, and remediation activities.
• Maintain reporting and documentation covering enrollment, patching, compliance, application deployment, security coverage, configuration standards, runbooks, and approved exceptions.
• Partner with IT leadership, infrastructure, Service Desk, business stakeholders, auditors, vendors, and security partners to resolve risks and continually strengthen enterprise technology standards.
• Identify recurring or systemic endpoint and security issues, determine root causes, and implement durable solutions that reduce risk, repeat incidents, and manual work.
• Adapt to changing business priorities and organizational growth while maintaining consistent security and endpoint management standards across the enterprise.

Qualifications

Required

• 5+ years of progressive experience in enterprise endpoint management, endpoint engineering, systems administration, cybersecurity, or a related area, with demonstrated ability to independently own and administer an enterprise technology platform.
• Hands-on production experience managing Windows endpoints at scale through Microsoft Intune, including configuration profiles, compliance policies, security baselines, Windows Autopilot, enrollment, and provisioning.
• Experience packaging, testing, and deploying applications through Intune, including detection and requirement rules, dependencies, deployment monitoring, and remediation.
• Experience administering Windows Update for Business, including update rings, patch compliance, pilot and production deployments, and remediation workflows.
• Working knowledge of Microsoft Defender for Endpoint, Microsoft Entra ID, Conditional Access, device identity, and MFA.
• Proficiency using PowerShell for endpoint administration, automation, reporting, and remediation.
• Experience supporting cybersecurity controls, audits, compliance validation, risk remediation, or related security program activities.
• Strong troubleshooting and analytical skills, including the ability to identify root causes and resolve endpoint enrollment, application deployment, policy, patching, and compliance issues.
• Ability to prioritize technical work and security risks based on business impact and security exposure.
• Strong documentation, communication, and cross-functional collaboration skills, including the ability to communicate technical issues and risks to both technical and non-technical stakeholders.

Preferred

• Experience administering endpoint environments supporting 1,000+ users or devices, particularly within a multi-office or multi-entity organization.
• Experience with acquisition integration, endpoint platform migrations, or technology standardization across newly acquired organizations.
• Experience within architecture, engineering, construction, professional services, or another application-intensive environment.
• Experience with Defender Vulnerability Management, MDM/MAM, or certificate-based endpoint authentication.
• Working knowledge of cybersecurity frameworks such as NIST, CMMC, CIS, or comparable control frameworks.
• Understanding of ITSM practices, including incident, problem, and change management.
• Experience developing or maintaining endpoint security, compliance, or operational reporting and dashboards.
• Microsoft Endpoint Administrator Associate, Identity and Access Administrator Associate, CompTIA Security+, or similar technical/security certification.

Why you’ll love Stratus

• A team-oriented environment that values transparency, creativity, and shared success
• Meaningful career paths, leadership opportunities, and space to specialize
• Learning & Development - Education and Professional Licensing
• We believe flexible, hybrid work supports the balance and well-being our team deserves
• Excellent Health Care Programs - Medical, Dental, and Vision Insurance
• Company-paid Life Insurance, Short-Term Disability, and Long-Term Disability
• Voluntary Life Insurance options for employees, spouses, and dependents
• 401k Retirement Plan with employer match
• Paid Holidays & Competitive PTO plans

Equal Opportunity Statement

Stratus is an Equal Opportunity Employer that does not discriminate on the basis of actual or perceived race, color, creed, religion, national origin, ancestry, citizenship status, age, sex or gender (including pregnancy, childbirth, pregnancy-related conditions, and lactation), gender identity or expression (including transgender status), sexual orientation, marital status, military service and veteran status, physical or mental disability, genetic information, or any other characteristic protected by applicable federal, state, or local laws and ordinances. Stratus Team’s management Team is dedicated to this policy with respect to recruitment, hiring, placement, promotion, transfer, training, compensation, benefits, employee activities, access to facilities and programs, and general treatment during employment.