Consultancy: Modern Desktop Management Consultant, ICTD Digital Core, Valencia, Spain, 3 months (on-site)

Consultant IT & Telecom

Overview

Join UNICEF to support key technical initiatives in global Windows Device Management.

You have:

• Bachelors Degree in Computer Science or similar is desirable.
• Certifications on Windows Client, Windows Server, Device Management Technologies are desirable.
• Proven Knowledge of Windows Client on Intel-based Workstations and Laptops is required.
• Proven Experience Deploying and Upgrading MS Windows on a Significant Number of Machines is required.
• Proven Experience Supporting Windows Client Devices Encrypted with Bitlocker is required.
• 5 Years Experience Supporting End-User Computing is required.
• Capacity to Dive-deep into Troubleshooting Windows-based Systems is required.
• Experience of Endpoint Management Tools like Active Directory, GPOs, Intune, WSUS, Ivanti is required.
• Fluency in English is required. Knowledge of another official UN language (Arabic, Chinese, French, Russian or Spanish) is an asset.

Contract

This is a Consultancy contract. More about Consultancy contracts.

UNICEF works in some of the world's toughest places, to reach the world's most disadvantaged children. To save their lives. To defend their rights. To help them fulfill their potential.

Across 190 countries and territories, we work for every child, everywhere, every day, to build a better world for everyone.

And we never give up.

For every child, a connected world

The overarching strategic goal of UNICEF’s Information and Communication Technology Division (ICTD) is to transform and build partnerships with our stakeholders to successfully implement UNICEF programmes globally through the use of innovative technology-enabled solutions.

How can you make a difference?

We are seeking a proficient consultant to join our team to support key technical initiatives around UNICEF Global Windows Device Management. The consultant will be pivotal in assisting with system upgrades, migrations, and the transition to cloud-based management. An understanding of Windows systems, Azure AD, and Intune configuration profiles will be beneficial for this role. If you are detail-oriented, a problem solver, and ready to contribute to a global team, we encourage you to apply.

Scope of Work and Key Responsibilities:

* Assistance in the Technical Implementation and Coordination on the Release to UNICEF Globally of the Windows 10 22H2 Feature Upgrade

Computers with Microsoft Windows 10 today in UNICEF have version 20H2 that will be unsupported, we will be deploying globally a Feature Upgrade Package to those computers, bringing them to supported Windows 10 22H2

Responsibilities:

Generate a list of computers to be upgraded to Windows 10 22H2, collaborate in the selection of computers for testing, Closed Pilot, Open Pilot. Gather feedback from each of the test groups with the results and troubleshooting possible problems related with the upgrade, updating KB articles and procedural documentation on findings and best practices

Additionally:

In coordination with Windows Client SME, Ivanti and Modern Desktop Management SMEs activities related to advancing and following up with the deployment and adoption process

* Assistance in the Technical Implementation and Coordination on the UNICEF Global migration from MBAM

Service to Azure AD-backed Bitlocker Encryption

This migration is necessary as MBAM will no longer be supported after April 2026, leaving it vulnerable to security risks and compatibility issues with newer versions of Windows and other software.

Responsibilities:

Generate a comprehensive list of BitLocker recovery keys in the current MBAM SQL Server.

Set up Microsoft Endpoint Manager (MEM) policy to securely store BitLocker recovery passwords in Azure AD Device Accounts.

Utilize Azure AD's Graph API to generate a list of BitLocker recovery keys and compare it with the MBAM list.

Manually escrow any missing recovery keys to Azure AD for seamless recovery.

Assist in the smooth shutdown and decommissioning of the MBAM server.

Additionally:

Provide guidance on removing any group policy settings conflicting with Intune Bitlocker policies, if applicable.

The consultant will work closely with the PSD CORE team to ensure a successful migration, minimizing any disruption to operations and ensuring the security of data throughout the process. The consultant should have a strong understanding of Azure AD, BitLocker encryption, and experience with MBAM migration projects.

* Assistance in the Initial Assessment and Inventory of UNICEF On-Prem Windows Client and Server Group Policies (GPOs) for the Migration to Modern Intune Configuration Profiles

Windows Client and Server Group Policies (GPOs) are used to manage computers and users on the network. The objective is to evaluate the feasibility and plan for the migration to Modern Intune Configuration Profiles, which allows for cloud-based management of devices and computers.

Responsibilities:

Conduct a comprehensive assessment of the current on-premises Windows Client and Server Group Policies (GPOs) in use at UNICEF.

Identify and document the specific policies and settings configured within the GPOs, including password requirements, software installation rules, and other configuration settings.

Collaborate with the UNICEF team to determine the desired configuration and policies to be implemented in the Modern Intune Configuration Profiles.

Create an inventory of the devices and computers that are currently managed by the on-premises GPOs.

Develop a migration plan that outlines the necessary steps to transition from the existing GPOs to the Modern Intune Configuration Profiles.

Test the migration process on a subset of devices to ensure compatibility and functionality before implementing the changes across all devices.

Additionally:

Provide guidance on utilizing co-management, which allows for the gradual transition of tasks from Configuration Manager to Intune while maintaining some functions on the existing system.

Assist in identifying and removing any conflicting settings in GPOs to ensure a smooth transition to Intune.

The consultant will work closely with the UNICEF team to ensure a seamless and successful migration to Modern Intune Configuration Profiles. The consultant should have a strong understanding of Group Policies, Intune configuration profiles, and experience with similar migration projects.

Work Assignment Overview

Work Description

Deliverable Output

Delivery Deadline

Win10 22H2 Upgrade

Initial List of computers to be upgraded to Windows 10 22H2

31-Oct-2023

Win10 22H2 Upgrade

Draft Selection of computers for testing, Closed Pilot, Open Pilot

MBAM Migration

Review and Initial report of BitLocker-encrypted devices, BitLocker correlation of backed-up keys in AAD.

GPO Intune Migration

Initial Draft Report of desired configuration and policies to be migrated for Modern Intune Configuration Profiles

Win10 22H2 Upgrade

Report on Coordination activities with Windows Client SME, Ivanti, and Modern Desktop Management SMEs activities

Device Data Warehouse

Assist primarily the Windows Client, but also the Intune and Software and Patch Deployment SMEs in activities that will enable the drafting of a flow to collect, correlate and feed reports on Windows Device Data

GPO Intune Migration

Initial Documentation of specific policies and settings configured within the GPOs

MBAM Migration

Updated Review and report of BitLocker-encrypted devices, bitlockers reporting a backed up key in AAD, in-depth report on troubleshooting steps on any possible gaps

30-Nov-2023

Win10 22H2 Upgrade

Updated Summary Feedback from test groups with results and troubleshooting documentation

Win10 22H2 Upgrade

Updated KB articles and procedural documentation on findings and best practices

GPO Intune Migration

Report on Testing Activities of migration process on subset of devices to ensure compatibility and functionality

MBAM Migration

Report on Escrowed missing recovery keys to Azure AD for seamless recovery - if any

MBAM Migration

Report on Outcomes of shutdown and decommissioning of the MBAM server

Device Data Warehouse

Assist primarily the Windows Client, but also the Intune and Software and Patch Deployment SMEs correlating preliminary Device Data Warehouse reports with first-and LSAs from HQ, RO and FO Device Inventories and actual devices

MBAM Migration

Report of Findings on on removing group policy settings conflicting with Intune Bitlocker policies (if applicable)

Win10 22H2 Upgrade

Final List of computers to be upgraded to Windows 10 22H2

31-Dec-2023

Win10 22H2 Upgrade

Adoption Report on computers for testing, Closed Pilot, Open Pilot and General Release

MBAM Migration

Final Review of BitLocker-encrypted devices, bitlockers reporting a backed-up keys in AAD, in-depth report on troubleshooting steps on any possible gaps

Win10 22H2 Upgrade

Report on Coordination activities with Windows Client SME, Ivanti, and Modern Desktop Management SMEs activities

GPO Intune Migration

Documentation of specific policies and settings configured within the GPOs

Device Data Warehouse

Report of activities performed assisting CORE SMEs with collection, validation and feedback on the Device Data together with LSAs from HQ, RO and FOs

GPO Intune Migration

Final Report on Migrated GPOs to Intune Profiles

Financial Proposal:

Please indicate your ability, availability and rate (in US$) to undertake the terms of reference above (including all deliverables and travel, daily subsistence allowance, if applicable). Applications submitted without a financial proposal will not be considered.

To qualify as a champion for every child you will have…

Professional Experience/Knowledge/Expertise/Skills required:

• Bachelors Degree in Computer Science or similar is desirable.
• Certifications on Windows Client, Windows Server, Device Management Technologies are desirable.
• Proven Knowledge of Windows Client on Intel-based Workstations and Laptops is required.
• Proven Experience Deploying and Upgrading MS Windows on a Significant Number of Machines is required
• Proven Experience Supporting Windows Client Devices Encrypted with Bitlocker is required.
• 5 Years Experience Supporting End-User Computing is required.
• Capacity to Dive-deep into Troubleshooting Windows-based Systems is required.
• Experience of Endpoint Management Tools like Active Directory, GPOs, Intune, WSUS, Ivanti is required.

Language Requirements:

Fluency in English is required. Knowledge of another official UN language (Arabic, Chinese, French, Russian or Spanish) is an asset.

For every Child, you demonstrate…

UNICEF's values of Care, Respect, Integrity, Trust, Accountability, and Sustainability (CRITAS).

To view our competency framework, please visit here.

UNICEF is here to serve the world’s most disadvantaged children and our global workforce must reflect the diversity of those children. The UNICEF family is committed to include everyone, irrespective of their race/ethnicity, age, disability, gender identity, sexual orientation, religion, nationality, socio-economic background, or any other personal characteristic.

UNICEF has a zero-tolerance policy on conduct that is incompatible with the aims and objectives of the United Nations and UNICEF, including sexual exploitation and abuse, sexual harassment, abuse of authority and discrimination. UNICEF also adheres to strict child safeguarding principles. All selected candidates will be expected to adhere to these standards and principles and will therefore undergo rigorous reference and background checks. Background checks will include the verification of academic credential(s) and employment history. Selected candidates may be required to provide additional information to conduct a background check.

Remarks:

Only shortlisted candidates will be contacted and advance to the next stage of the selection process.

Individuals engaged under a consultancy or individual contract will not be considered “staff members” under the Staff Regulations and Rules of the United Nations and UNICEF’s policies and procedures, and will not be entitled to benefits provided therein (such as leave entitlements and medical insurance coverage). Their conditions of service will be governed by their contract and the General Conditions of Contracts for the Services of Consultants and Individual Contractors. Consultants and individual contractors are responsible for determining their tax liabilities and for the payment of any taxes and/or duties, in accordance with local or other applicable laws.

The selected candidate is solely responsible to ensure that the visa (applicable) and health insurance required to perform the duties of the contract are valid for the entire period of the contract. Selected candidates are subject to confirmation of fully-vaccinated status against SARS-CoV-2 (Covid-19) with a World Health Organization (WHO)-endorsed vaccine, which must be met prior to taking up the assignment. It does not apply to consultants who will work remotely and are not expected to work on or visit UNICEF premises, programme delivery locations or directly interact with communities UNICEF works with, nor to travel to perform functions for UNICEF for the duration of their consultancy contracts.

UNICEF offers reasonable accommodation for consultants with disabilities. This may include, for example, accessible software, travel assistance for missions or personal attendants. We encourage you to disclose your disability during your application in case you need reasonable accommodation during the selection process and afterwards in your assignment.

Apply now

Potential interview questions

Added 2 years ago - Updated 1 year ago - Source: unicef.org