Business Introduction
GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.
Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.
Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.
Job Purpose
Be the definitive technical authority for how 50,000+ employees across [X] countries experience and interact with their devices. This role owns the architecture, reference designs, technical standards and engineering direction for the entire end user computing estate — laptops, desktops, mobiles, tablets, virtual desktops, meeting rooms, and specialised or regulated endpoints.
Where the Director owns delivery, budget and people, the Principal Architect owns what good looks like technically and holds the organisation to it. This is a hands-on-capable role: the expectation is to prototype, prove and pressure-test designs personally, not solely to review other people's slides.
The Principal Architect is accountable for ensuring the estate is secure by design, cloud-native, automatable, cost-efficient and — critically — genuinely pleasant to use. They are the person who says no to architecture that will not survive contact with 50,000 users, and who can explain why in terms both engineers and executives accept.
Key Responsibilities
- Own the target-state architecture for end user computing: platform selection, device management topology, identity integration, application delivery, security control placement and telemetry.
- Produce and maintain reference architectures, design patterns, technical standards and architecture decision records (ADRs) — with trade-offs made explicit rather than buried.
- Define the technical roadmap that underpins the EUC strategy: platform migrations, deprecations, convergence of fragmented tooling, and the sequencing that makes it deliverable.
- Continuously evaluate the market — modern management, AI PCs and on-device inference, cloud PC/DaaS economics, zero-trust endpoint models — and separate genuine capability from vendor narrative.
- Act as the design authority for all endpoint change: chair or sit on the EUC architecture review board, approve significant designs, and hold veto on standards deviation.
- Set and police the exception process — make the right path the easy path, and make deviations visible, time-bound and owned.
- Review and assure supplier and MSP technical designs; ensure partners build to the organisation's architecture rather than their own delivery convenience.
- Set engineering standards for configuration-as-code, packaging, testing, release management and rollback across the endpoint estate.
- Prototype and prove new capability in a lab before it reaches production; build the reference implementation the engineering teams then industrialise.
- Mentor and technically develop senior engineers and platform leads; raise the ceiling of the whole team, not just your own output.
- Partner with Cyber Security to embed zero-trust principles at the endpoint: device trust and attestation, conditional access, least privilege, application control, EDR and DLP placement.
- Architect for regulated and validated environments — GxP-qualified endpoints, computer system validation (CSV/CSA), data residency and privacy obligations, and audit/SOX ITGC evidence generation as a designed-in property rather than a manual scramble.
- Own the technical response to endpoint-relevant threat scenarios and drive architectural remediation of systemic vulnerabilities.
- Architect the digital employee experience (DEX) telemetry model: what is measured, how it is collected, where it lands, and how it drives automated remediation.
- Design for self-healing and self-service by default; treat every recurring ticket category as an architectural defect until proven otherwise.
- Translate architecture into business consequence for senior stakeholders — cost, risk, productivity, time-to-value.
- Represent EUC architecture in enterprise architecture forums, security governance, and vendor executive briefings.
Professional Qualifications
- Bachelor's degree in Computer Science, Engineering or a related technical discipline, or equivalent demonstrable professional expertise.
- Relevant certifications desirable (e.g., Microsoft Certified: Endpoint Administrator Expert, Azure Solutions Architect Expert, Cybersecurity Architect Expert, Jamf Certified Expert, TOGAF, CISSP or SABSA).
Area of Specialisation
- End user computing architecture at global enterprise scale — platform selection, device management topology, identity integration, application delivery and telemetry.
- Modern endpoint management (Intune/MECM) and macOS management (Jamf), including co-management, hybrid-to-cloud-native migration and staged ring-based rollout.
- Endpoint security architecture and zero-trust design — device trust, conditional access, application control, EDR/XDR, DLP and secure baselines.
- Regulated and validated endpoint environments — GxP-qualified endpoints, CSV/CSA, data residency and audit/SOX ITGC evidence generation designed in.
Experience Required
- Overall 15 years and 12+ years in IT infrastructure or end user computing, including 5+ years in a principal, lead or enterprise architect capacity with recognised design authority.
- Architecture ownership for an endpoint estate of 20,000+ devices across multiple countries and regulatory jurisdictions.
- Expert-level, hands-on-derived command of modern endpoint management (Intune/MECM) and macOS management — sufficient to build the reference implementation personally, not only to specify it.
- Demonstrable advanced scripting and automation portfolio; evidence of configuration-as-code applied to a production endpoint estate.
- Working fluency in enterprise endpoint security and zero-trust architecture, with a track record of co-designing controls alongside a Cyber Security function.
- Led the architecture of at least one large-scale endpoint platform migration or transformation through to production, including the failures and what was learned from them.
- Able to produce architecture documentation of a standard that withstands external audit and supplier scrutiny.
- Proven credibility with both senior engineers and executive stakeholders, in English, in a global matrixed organisation.
- Willingness to travel internationally, approximately [5–15]% of the time.
Desirable:
- Experience in a regulated industry — pharmaceutical, life sciences, biotech, financial services or healthcare — with practical GxP/CSV/CSA and Annex 11 / 21 CFR Part 11 exposure.
- Architecture for specialised endpoints: laboratory instrument workstations, manufacturing and shop-floor devices, clinical and field devices, kiosks, shared and multi-user workstations.
- Leading a major platform transformation: SCCM-to-Intune migration, Windows 10→11 at scale, MSP transition, or M&A integration/divestment of an endpoint estate.
- Sustainability-aware design — device longevity, power management, refurbishment and Scope 3 implications of architectural choices.
- Accessibility and assistive technology designed into the standard build rather than bolted on.
- Network fundamentals relevant to endpoints — SASE/ZTNA, split tunnelling, Wi-Fi 6/7, certificate-based network access.
- Contribution to the wider community — open-source tooling, conference speaking, published technical writing, vendor customer advisory boards.
Skills/Background
- Deep technical breadth across Windows and macOS internals, modern endpoint management, identity, endpoint security, application delivery, virtual desktop / cloud PC, and mobile — with the judgement to know where tenant-wide standardisation matters and where a business exception is defensible.
- Advanced PowerShell and at least one general-purpose language (Python, C#, Go) applied to real automation, not toy scripts.
- Configuration-as-code and GitOps discipline — version-controlled endpoint configuration, CI/CD for policy and package deployment, automated testing and staged ring-based rollout as the default way endpoint change is delivered.
- API-first integration — Microsoft Graph, ServiceNow, MDM and security tool APIs; designing integrations that survive vendor change.
- Telemetry and data craft — designing measurement into the estate, with competence in the query languages and platforms the data lands in (KQL, Log Analytics, Power BI or equivalent).
- Architectural discipline — reference designs, ADRs, HLD/LLD, and the ability to write clearly enough that others can build from it and external auditors can accept it.
- Trade-off reasoning — cost, risk, experience, security and operability weighed explicitly; comfortable being the person who quantifies the uncomfortable option.
- Scale intuition — designing for 50,000 devices, unreliable networks, disconnected users, and the long tail of exceptions that always exists.
- Technical leadership without authority — landing decisions across engineering, security, service delivery and vendors by credibility and evidence.
- Executive communication — making architecture legible and decision-ready for non-technical leadership.
- Constructive challenge — able to disagree with a Director, a vendor or a security architect and keep the relationship intact.
#AGTech
Skills
Cloud Infrastructure, Cybersecurity, Design Thinking, Endpoint Encryption, Endpoint Security, End User Services, Financial Operations, Jamf Pro, Network Protocols, Network Security, Zero Trust
Why GSK?
Uniting science, technology and talent to get ahead of disease together.
GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.
People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.
Inclusion at GSK:
As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.
Please contact our Recruitment Team at IN.recruitment-adjustments@gsk.com to discuss your needs.
Important notice to Employment businesses/ Agencies
GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.
It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.
GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.
If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing askus@gsk.com, so that we can confirm to you if the job is genuine.