CURRENT ROLE ONLY FOR EUROPE_BASED CANDIDATES!
We're looking for a Senior Windows Kiosk Imaging Engineer to take an existing Windows 11 IoT Enterprise kiosk image from lab prototype to release master. The devices run a Unity application in Shell Launcher kiosk mode; you won't touch the application itself, but you'll own everything around it — provisioning, lockdown, account structure, driver integration, and the capture/restore pipeline that gets the image onto real hardware. A master image already exists and boots, but seven open items currently block deployment, and full documentation for the existing scripts, handbook, and procedures will be handed over at the start. The first phase is release-master work and is the busiest period; once deployment is stable, the engagement shifts into lighter, ongoing image support and maintenance. You'll work directly with the project's technical lead and build on a documented script tree and handbook left by the previous engineer, rather than starting from a blank page. This is senior, hands-on Windows systems and imaging work — not application development — for someone who can be productive configuring the environment from day one.
Details: Schedule: Full time Location: Remote in Europe Start: ASAP Duration: Long-term English: Fluent Type of collaboration: B2B Contract
About the project: The project involves a fleet of Windows 11 IoT Enterprise kiosk devices running a Unity application locked down via Shell Launcher kiosk mode. A master image already exists on a lab USB stick — it boots and runs, but it isn't yet a release master, and seven documented items remain open before it can be deployed at scale. The work spans PowerShell provisioning, account and autologon rework, sysprep and answer-file configuration, driver integration across two hardware board revisions, boot-chain and firmware considerations (UEFI, Secure Boot, custom boot logo), and disciplined handling of Windows Update. Image capture and restore currently run through Clonezilla, with Rescuezilla used for field backups; documentation covering capture, packaging, and restore already exists and will be shared. Two known security items — a plaintext administrator password in a shipped config file, and a shared API key/TOTP secret embedded in the application — are also in scope, though not blocking deployment. You'll validate all work first against a reference machine and then on real kiosk hardware.
You have: - Senior, hands-on experience with Windows systems and imaging — deep enough to configure kiosk mode, build ISO images, and troubleshoot at a low level - Proven, practical experience configuring Windows kiosk mode (Shell Launcher), including keyboard filtering and locking down what the running account can do - Strong PowerShell scripting experience: local accounts, registry policy, ACLs, services, scheduled tasks, and RunOnce entries - Experience with master image workflows — sysprep and unattend.xml, disk shrink/extend, and image capture/restore (Clonezilla, Rescuezilla, or equivalent) - Experience integrating drivers for specific target hardware, ideally across multiple board revisions - Familiarity with boot chain and firmware topics: UEFI, Secure Boot, custom boot logos - Comfort managing Windows Update behavior consistently across a reference machine, a captured image, and deployed devices - Ability to describe past relevant projects and experience in detail — general familiarity or willingness to learn is not a substitute for proven, hands-on experience - Ability to join and start configuring the environment almost immediately, without an extended ramp-up period
What to do: - Replace the image's current provisioning scripts wholesale with the up-to-date pipeline, and remove leftover scheduled tasks from the previous design - Rework the local account structure down to exactly two accounts: a passwordless standard kiosk user and a password-protected local administrator, retiring lega
