Joshua Walderbach

Systems & Infrastructure Engineer III

Engineers the endpoint platform behind ~384,000 Windows devices — named Lead for all Windows kiosks, leading Windows servicing modernization, and building the internal products the team runs on. Increasingly focused on platform reliability over firefighting: preventing incidents before they reach users, not just resolving them faster.

• Named Lead for all Windows kiosks — hold architecture and approval authority over a ~54,000-device domain, owning kiosk role architecture end to end, from the thin-client (IGEL) vs. Windows platform-selection decision through Windows Autopilot deployment
• Built Trellix-Cleanup (open-sourced — the code is public), a PowerShell Intune remediation that saved approximately 10,000 Windows devices from becoming unrecoverable, avoiding an estimated $18M–$24M in hardware replacement
• Lead Walmart's Windows servicing migration from SCCM to Windows Update for Business, and redesigned the global servicing schedule — adopted across all markets — that lifted monthly patch compliance from under 50% to over 90%
• Helped cut product support tickets 90% year-over-year (a team objective) through automation, not added staffing — OSD imaging automation, Intune Proactive Remediations that correct configuration drift, and self-healing scripts that fix common issues before users notice
• One of 3 engineers trusted to approve production code for the Windows Engineering (OS) team — gatekeeping quality and traceability through structured peer review
• Authored detect-and-remediate scripts (Intune Proactive Remediations) that closed high-profile Windows exposures across the estate — Git for Windows, PrintNightmare, and Secure Boot certificate-update blockers; on the Git for Windows work, caught that the official vulnerability scan was under-reporting and surfaced roughly 3× more affected devices than it showed
• Co-built the Endpoint Hardware decision-tree matrix that governs kiosk platform selection, and authored the kiosk-provisioning whitepaper that standardized role design to cut per-role complexity and support burden
• Partnered with the Security team to prove out Microsoft Intune DLP as the enterprise replacement for a legacy third-party DLP agent — now the company's data-loss-prevention solution, retiring redundant endpoint-security tooling
• Built an internal AI-powered web application that converts plain-English requests into INVEST-compliant Jira stories, with human-in-the-loop approval, direct Jira integration, and Microsoft Entra ID SSO
• Built an internal PowerShell application that administers ~155 Windows Update for Business ring policies across every domain through Microsoft Graph — replacing slow, change-risky portal work with one-command servicing: enterprise-wide pause/resume, WhatIf previews, an automatic backup before every change, and one-command rollback
• Led the phased Windows 11 upgrade of 18,000+ employee-facing kiosks via SCCM task sequences — diagnosing and resolving deployment failures that only surfaced at fleet scale
• Rebuilt ~500 customer-facing in-store ordering kiosks from a Windows 10 multi-app desktop to a locked-down Windows 11 single-app experience, cutting support complexity and shrinking the attack surface
• Drove Walmart's migration of Group Policy configurations to Intune MDM — managing the Microsoft Entra ID groups that target Intune policy, Windows Autopilot enrollment, and cloud-native device configuration at scale
• Authored Intune device compliance baselines (encryption, OS-version, security-health) and hardened the endpoint attack surface with Intune Device Control — restricting USB/removable storage, Bluetooth, and connected-device access to prevent data exfiltration (endpoint DLP)
• Built True Logon — tamper-resistant logon tracking with automated stale-profile cleanup on shared devices — to kill a recurring profile-bloat failure at the root, then handed day-to-day ownership to a junior engineer I mentor, growing another engineer while scaling myself out of the maintenance
• Administered the team's GitHub organization — establishing repository and peer-review standards now the single source of truth for 100% of the Windows Engineering (OS) team — and built GitHub101, a self-paced training platform with in-browser Git simulators
• Scoped ambiguous requests into recommendations that set technical direction — a Windows toast-notification feasibility study for a partner organization and a proposal to automate software-install requests through ServiceNow
• Standardized a partner team's US-wide printer fleet — a PowerShell repoint to a new print server that also corrected drift and standardized names, ports, and drivers — then handed it off to self-serve; built a Python tool that publishes Markdown docs into Confluence for partners across departments
• Built the team's diagnostics product line — WinDAS (full-system diagnostics with interactive HTML reports), PULSE (60-second performance triage generating ServiceNow-ready work notes), and an internal configuration-reporting tool — plus a role-based framework that restores devices to a known-good state
• Shipped self-service products adopted beyond the engineering team — Kiosk Overseer (guided Windows Assigned Access kiosk builder exporting deployment-ready XML, PowerShell, and .intunewin) and Portal Maker (no-code branded landing pages deployable via Intune or SCCM); kiosk tooling I built earned recognition in the Microsoft Intune practitioner community
• Built a Microsoft Graph–based tool that snapshots configuration for auditable, versioned documentation, plus reusable PowerShell modules for remote administration in segmented networks; designed a consolidated endpoint role that runs multiple business workloads on one managed configuration

Systems & Infrastructure Engineer II

Recruited into Windows Engineering on the strength of automation built in the support organization — taking ownership of Intune, SCCM, Windows servicing, Windows 11 deployment, and Microsoft 365 application packaging across ~384,000 endpoints.

• Cut support-queue volume by ~65% by shipping PowerShell drift-remediation tooling and proactive Intune configuration profiles that resolved issues before they became tickets
• Orchestrated a global Intune health-script deployment managing TLS/SSL cipher suites across ~384,000 Windows devices — partnering with Risk & Vulnerability Management to align with Brinqa vulnerability reporting and eliminate legacy protocols
• Directed migration of virtual environments from Configuration Manager to Windows Update for Business, reducing change controls from 24 to 6 through standardized patching and a streamlined approval process
• Built a ServiceNow-to-Power BI telemetry pipeline that surfaced incident patterns and enabled data-driven prioritization of proactive remediation
• Served as cross-functional liaison between OS Engineering and Vulnerability Management teams, authoring remediation strategies, PowerShell scripts, and Intune compliance configurations
• Researched and communicated monthly patch content to Risk Management, shaping rollout strategies aligned with risk-mitigation priorities

Associate Systems Engineer

• Built an internal menu-driven PowerShell framework consolidating 30+ engineering tools into one product, standardizing engineering procedures and reducing MTTR
• Built a PowerShell automation suite that cut average resolution time ~40% and measurably reduced ticket volume — introducing PowerShell across the support organization
• Technical lead for workstations, thin clients, printers, and virtual machines; provided advanced support for Microsoft 365 desktop applications (Word, Excel, Outlook) and mentored technicians
• Co-architected a skills-based assessment framework integrated with ServiceNow
• Implemented automated reporting that reduced escalations ~25%

Technician V → VI

Helped establish Walmart's overnight Level 2 Enterprise Operations organization from the ground up before promotion into systems engineering.

• Launched the "PowerShell in a Month of Lunches" learning series, establishing the team's automation foundation and lifting PowerShell skills across the global support organization
• Delivered global L2 support across collaboration, Microsoft 365 desktop applications, hardware, telephony, mobile, and virtualized endpoint domains — authoring SOPs that standardized troubleshooting across technology areas
• Built ServiceNow dashboards for real-time ticket-trend analysis and pioneered diagnostic utilities that became team standards
• Delivered overnight support to global distribution centers, maintaining 98% SLA compliance during high-volume windows