Modern Workplace Architect (6 month FTC)

We are looking for a Modern Workplace Architect to define and own the architecture of Nexthink's corporate digital workplace: how every Nexthinker's devices, collaboration tools, productivity suite and endpoint security fit together into one secure, cloud-native and frictionless experience. As a company that sells digital employee experience, our own workplace is our showcase - this role makes it one. This is a 6-month temporary position covering a maternity leave. You will partner with IT Operations on delivery, with the IAM and Security teams on standards and controls, and with business stakeholders on adoption, owning the target architecture and roadmap end to end. Key Responsibilities Workplace Strategy & Architecture • Define and own the modern workplace target architecture across endpoints, Microsoft 365, collaboration, and end-user services. • Develop and maintain the multi-year workplace roadmap, sequencing modernisation against business priorities, risk and cost. • Establish architecture principles, standards, reference designs and decision records for the corporate workplace estate. • Lead technology evaluations and vendor selection; scope and steer external partners while retaining internal ownership of design and standards. • Act as the design authority for changes affecting the employee digital experience. Endpoint Management & Device Lifecycle • Architect cloud-native endpoint management for Windows and macOS using Microsoft Intune and Jamf, including co-management retirement where applicable. • Design zero-touch provisioning (Windows Autopilot, Apple Business Manager / Automated Device Enrollment) for a global, hybrid workforce. • Define configuration baselines, patching and update rings (Windows Update for Business, macOS updates), and application packaging and delivery standards. • Own the device lifecycle model: onboarding, refresh, loss/theft, offboarding and secure wipe. Microsoft 365 & Collaboration • Own the architecture and governance of Microsoft 365: Exchange Online, Teams, SharePoint and OneDrive, including tenant configuration and lifecycle policies. • Define collaboration governance: workspace provisioning, external sharing, guest access, retention and sprawl control. • Architect integration and coexistence with the wider SaaS estate (e.g. Slack, Zoom, Google Workspace) where relevant. • Lead the secure adoption of Microsoft Copilot and other AI productivity tools, including data readiness, oversharing remediation and usage policies. Endpoint Security & Zero Trust • Partner with Security and IAM to design Zero Trust controls for the workplace: device compliance, Conditional Access, and identity-bound device trust. • Define endpoint security baselines and architecture for EDR, disk encryption, local admin removal and application control. • Design data protection controls with Microsoft Purview: sensitivity labels, DLP and information protection across devices and collaboration tools. • Support ISO 27001 and SOC 2 audit readiness with documented workplace controls and evidence. Digital Employee Experience & Automation • Use Nexthink's own DEX platform to measure and improve employee experience; act as an internal reference customer and feed insights back to Product. • Drive self-service and automated remediation to reduce ticket volume and time to resolution. • Automate workplace operations with PowerShell, Microsoft Graph and scripting, and set engineering standards for workplace automation. • Act as the technical escalation point for complex workplace incidents and architectural decisions. • 8+ years in end-user computing, modern workplace or enterprise IT, including 3+ years in an architect or senior technical lead role. • Demonstrable track record designing and delivering cloud-native workplace architectures at enterprise scale for a distributed, hybrid workforce. • Deep hands-on expertise in Microsoft Intune and Windows Autopilot; strong experience managing macOS with Jamf or equivalent. • Expert knowledge of Microsoft 365 architecture and governance: Exchange Online, Teams, SharePoint and OneDrive. • Solid understanding of Microsoft Entra ID, Conditional Access and Zero Trust principles applied to devices and collaboration. • Experience with endpoint security and data protection: Defender for Endpoint (or equivalent EDR), Microsoft Purview, encryption and application control. • Automation skills with PowerShell, Microsoft Graph API or similar scripting. • Familiarity with ISO 27001 or SOC 2 controls and audit evidence. • Experience with DEX or end-user experience monitoring tools is a strong plus; exposure to Copilot or AI productivity rollouts is a plus. • Relevant certifications (e.g. Microsoft Certified: Enterprise Administrator Expert, Endpoint Administrator, Cybersecurity Architect) are a plus. • Ability to communicate architecture decisions clearly to senior IT, Security and business stakeholders. Fluent English. Curious what we build on? Have a look at how Nexthink scales to trillions of events per day with Amazon MSK, powers real-time alerts with Amazon Managed Service for Apache Flink, and builds enterprise AI agents with fine-tuned LLMs on Amazon SageMaker. We are the pioneers and trailblazers of a global IT Market Category (DEX) that is shaping the future of how the world works, giving our customers’ IT Teams total digital visibility across their enterprise. Our innovative solutions integrate real-time analytics, automation, and employee feedback across all endpoints. This enables our IT teams to solve complex technical challenges, create ever more productive workplaces, and deliver happy, satisfied employees in the digital workplace. With over 1200 employees across 5 continents, Nexthink operates as One Team, connecting, collaborating and innovating to continuously grow. We call our employees ‘Nexthinkers’ and our commitment to diversity, inclusion, and equity is second to none. We currently have over 75 nationalities working with us, from all cultures and backgrounds, speaking many different languages If you are looking for a change and like a nice atmosphere, lots of challenges, and having fun while working, this is a great opportunity for you! Check what we offer: • 💼 Permanent Contract and a competitive compensation package. • 📍 Amazing centrally located offices near the Bernabeu Stadium. • 🩺 Private Health Insurance (Sanitas) and daily meal vouchers of 11 EUR will be entirely covered by us. • 🏡 Hybrid work model balancing office and remote work, with a structured approach for new hires to foster connections and onboarding. • 🏖️ Flexible Hours and unlimited vacation (employees have unlimited paid time off on top of the 23 days of holidays we offer) plus 3 company-paid volunteer days. • 🤸 Up to 25 EUR per month for a gym subscription. • 🛴 Flexible compensation plan for childcare & public transportation. • 🧑‍🏫 Reimbursement of up to 50% of the cost of English & Spanish classes. • 🍉 Fresh fruit, cookies, soft drinks and protein shakes at the offie. • 🍕 Regular company and team events like Pizza talks, Team Building activities, Christmas parties, hosting Meetups at the office and more! • 📣 Bonuses for referring successful hires after three months of continuous employment. • 🚚 We offer a relocation package to people who are coming from another country. Please note that not all the benefits listed above are available for temporary, contract, and internship roles. To ensure you have the most up-to-date information, we recommend checking with your Recruitment Partner.