Assoc Prin Eng MDM - VMware WorkspaceOne

This position is for a L3 Engineer will act as a subject-matter expert for a multi-tenant Workspace ONE MSP environment supporting approximately 30 clients, spanning shared managed-service tenants, dedicated customer SaaS consoles, and legacy on-premises deployments. The L3 Engineer is accountable for integrations, escalated incident resolution, upgrade planning, automation strategy, and technical governance across all supported customer environments.

Platform Architecture & Environment Management: Own the end-to-end Workspace ONE architecture across SaaS, Hybrid, and On-Premises models, covering UEM, Workspace ONE Access, Unified Access Gateway (UAG), Assist, Intelligence, ACC/AWCM connectors, and gateways. Define Organization Group hierarchies (tenant, sub-OGs, staging, platform-based, and business-unit OGs), global UEM settings, and environment segregation across dev/test/pre-prod/production, controlling configuration promotion between environments. Plan, document, and execute upgrades for UEM, Access, UAG, Assist, and related components, including rollback readiness and post-upgrade validation. Enrollment & Device Lifecycle: Design enrollment strategies for Android, iOS, macOS, Windows, and rugged devices across Corporate-Owned, Corporate-Shared, and BYOD models, including Autodiscovery, zero-touch, DEP/Automated Device Enrollment, Windows OOBE and PPKG provisioning, and staging scenarios. Policies, Profiles & Baselines: Define profile and baseline architecture per platform; design and debug custom ADMX/OMA-URI payloads; resolve conflicts between ADMX profiles, CIS/security baselines, custom settings, and legacy GPOs. Application Lifecycle: Own the application lifecycle strategy: Win32/MSI/EXE, PKG, APK/AAB and Managed Google Play, ABM/VPP delivery, Omnissa SDK integration, deployment ring design (pilot to broad), dependency and rollback planning. Android Enterprise & Rugged: Architect Android Enterprise deployments (Work Profile, Fully Managed, COPE, Dedicated) including rugged fleets, Secure Launcher kiosk designs, corporate-shared device workflows, and OS/app update strategy. Apple Ecosystem: Maintain the Apple ecosystem integrations: ABM/DEP profiles with supervision and user affinity, APNs certificate lifecycle, VPP token management, and resolution of ABM–VPP–UEM synchronization issues. Identity, SSO & Access: Design identity and access integrations: AD via ACC/LDAP, Microsoft Entra ID, Workspace ONE Access IdPs and access policies, SAML federations with third-party IdPs and SaaS applications, Android CertProxy SSO, iOS Kerberos SSO, conditional access design, and custom role/delegated administration models. UAG & Secure Access: Architect and operate UAG: OVA/OVF deployment in vSphere, Photon OS administration, one/two/three-NIC DMZ designs, HA behind enterprise load balancers (F5 or equivalent), session persistence design, and SSL passthrough/bridging/offloading topologies with correct certificate, cipher, and SNI handling. Design and troubleshoot Per-App VPN / Workspace ONE Tunnel with Device Traffic Rules, SEG (with/without Kerberos), Content Gateway, and ENS, including end-to-end network path analysis (routing, firewall, NAT, DNS, ports). PKI & Certificates: Define PKI strategy for certificate-based authentication; manage CAs, SCEP and issuance workflows, public SSL certificate lifecycles, Java keystores for AWCM, and deep trust-chain troubleshooting using OpenSSL (chains, CSR validation, TLS handshakes, CRL/OCSP, SAN/hostname mismatches). Automation & Intelligence: Design Freestyle Orchestrator workflows for onboarding, remediation, and change automation; integrate Workspace ONE Intelligence for dashboards, automations, webhooks/SIEM/ticketing integration, and management-level reporting. Privacy & Governance: Define privacy governance for BYOD/Corporate-Owned/Corporate-Shared scenarios aligned with customer contractual and