Modern Workplace Architect (6 month FTC)

We are looking for a Modern Workplace Architect to define and own the architecture of Nexthink's corporate digital workplace: how every Nexthinker's devices, collaboration tools, productivity suite and endpoint security fit together into one secure, cloud-native and frictionless experience. As a company that sells digital employee experience, our own workplace is our showcase - this role makes it one. This is a 6-month temporary position covering a maternity leave.

You will partner with IT Operations on delivery, with the IAM and Security teams on standards and controls, and with business stakeholders on adoption, owning the target architecture and roadmap end to end.

Key Responsibilities

Workplace Strategy & Architecture

• Define and own the modern workplace target architecture across endpoints, Microsoft 365, collaboration, and end-user services.
• Develop and maintain the multi-year workplace roadmap, sequencing modernisation against business priorities, risk and cost.
• Establish architecture principles, standards, reference designs and decision records for the corporate workplace estate.
• Lead technology evaluations and vendor selection; scope and steer external partners while retaining internal ownership of design and standards.
• Act as the design authority for changes affecting the employee digital experience.

Endpoint Management & Device Lifecycle

• Architect cloud-native endpoint management for Windows and macOS using Microsoft Intune and Jamf, including co-management retirement where applicable.
• Design zero-touch provisioning (Windows Autopilot, Apple Business Manager / Automated Device Enrollment) for a global, hybrid workforce.
• Define configuration baselines, patching and update rings (Windows Update for Business, macOS updates), and application packaging and delivery standards.
• Own the device lifecycle model: onboarding, refresh, loss/theft, offboarding and secure wipe.

Microsoft 365 & Collaboration

• Own the architecture and governance of Microsoft 365: Exchange Online, Teams, SharePoint and OneDrive, including tenant configuration and lifecycle policies.
• Define collaboration governance: workspace provisioning, external sharing, guest access, retention and sprawl control.
• Architect integration and coexistence with the wider SaaS estate (e.g. Slack, Zoom, Google Workspace) where relevant.
• Lead the secure adoption of Microsoft Copilot and other AI productivity tools, including data readiness, oversharing remediation and usage policies.

Endpoint Security & Zero Trust

• Partner with Security and IAM to design Zero Trust controls for the workplace: device compliance, Conditional Access, and identity-bound device trust.
• Define endpoint security baselines and architecture for EDR, disk encryption, local admin removal and application control.
• Design data protection controls with Microsoft Purview: sensitivity labels, DLP and information protection across devices and collaboration tools.
• Support ISO 27001 and SOC 2 audit readiness with documented workplace controls and evidence.

Digital Employee Experience & Automation

• Use Nexthink's own DEX platform to measure and improve employee experience; act as an internal reference customer and feed insights back to Product.
• Drive self-service and automated remediation to reduce ticket volume and time to resolution.
• Automate workplace operations with PowerShell, Microsoft Graph and scripting, and set engineering standards for workplace automation.
• Act as the technical escalation point for complex workplace incidents and architectural decisions.
• 8+ years in end-user computing, modern workplace or enterprise IT, including 3+ years in an architect or senior technical lead role.
• Demonstrable track record designing and delivering cloud-native workplace architectures at enterprise scale for a distributed, hybrid workforce.
• Deep hands-on expertise in Microsoft Intune and Windows Autopilot; strong experience managing macOS with Jamf or equivalent.
• Expert knowledge of Microsoft 365 architecture and governance: Exchange Online, Teams, SharePoint and OneDrive.
• Solid understanding of Microsoft Entra ID, Conditional Access and Zero Trust principles applied to devices and collaboration.
• Experience with endpoint security and data protection: Defender for Endpoint (or equivalent EDR), Microsoft Purview, encryption and application control.
• Automation skills with PowerShell, Microsoft Graph API or similar scripting.
• Familiarity with ISO 27001 or SOC 2 controls and audit evidence.
• Experience with DEX or end-user experience monitoring tools is a strong plus; exposure to Copilot or AI productivity rollouts is a plus.
• Relevant certifications (e.g. Microsoft Certified: Enterprise Administrator Expert, Endpoint Administrator, Cybersecurity Architect) are a plus.
• Ability to communicate architecture decisions clearly to senior IT, Security and business …