Endpoint Security Engineer

We are looking for an Endpoint Security Engineer to own the security of Nexthink’s corporate endpoint estate: roughly 1,200 devices (550 macOS, 650 Windows) managed through Microsoft Intune and Jamf. You will turn endpoint security from a set of point controls into a measurable, continuously improving program covering what runs on our devices, how quickly we patch them, and how we prove it to auditors.

This is a hands-on role at a pivotal moment, as we build out a dedicated security function. Your first priorities include application baselines and allowlisting, a formal application lifecycle from approval to removal, and stronger vulnerability and compliance posture across both platforms. As a company that sells digital employee experience, we expect security that protects people without getting in their way.

Key Responsibilities

Endpoint Hardening

• Define and maintain security baselines for macOS and Windows (CIS or equivalent), delivered through Intune and Jamf.
• Own hardening standards: disk encryption, firewall, local admin removal and privilege management.
• Evaluate endpoint security tooling and steer vendors while keeping internal ownership of design.

Application Control & Software Governance

• Design and roll out application allowlisting using MDM-native capabilities and/or tools such as Santa, with developer-friendly exception models for Engineering and Product.
• Build and maintain the software and binary inventory: discover, classify and risk-rate applications, and define baselines from the results.
• Run remediation campaigns for unauthorized or high-risk software, from communication to uninstallation and verification.
• Operate the application lifecycle process end to end: request, security review, deployment, monitoring and retirement.

Vulnerability & Patch Management

• Own endpoint vulnerability management: scanning, risk-based prioritization and remediation tracking against SLAs.
• Define patching and update rings for OS and third-party applications with EUC across macOS and Windows.
• Drive remediation of critical and zero-day vulnerabilities and report on exposure and performance to Security leadership.

Zero Trust & Data Protection

• Partner with IAM and Security to enforce device compliance and device trust in Conditional Access.
• Support endpoint data protection controls (e.g. Microsoft Purview DLP, USB and removable media controls) and hardware-backed authentication such as passkeys and security keys.

Compliance & Reporting

• Document endpoint controls and maintain automated evidence for ISO 27001, SOC 2 and ITGC audits.
• Turn security posture into clear metrics for IT leadership, Security and Finance.

Automation & Digital Employee Experience

• Automate security operations with PowerShell, Python, shell scripting, Microsoft Graph and the Jamf and Intune APIs.
• Use Nexthink’s own DEX platform to measure endpoint health and the employee impact of security changes, and build self-service remediation to reduce tickets.

Primary Metrics

• Device compliance and security baseline adherence (macOS and Windows)
• Mean time to remediate critical and high vulnerabilities, against SLA
• Patch and OS currency against SLAs
• Application control coverage and share of unclassified binaries
• Unauthorized or high-risk application count, and time to remediate
• Standing local admin count
• Endpoint-related audit findings and evidence automation coverage
• Employee experience impact of security controls (Nexthink DEX score)
• 5+ years in endpoint security, security engineering, or end-user computing with a strong security focus.
• Hands-on experience securing macOS and Windows at scale with Microsoft Intune and Jamf (or equivalent).
• Practical experience with vulnerability management tooling, prioritization and remediation workflows.
• Experience with application control and allowlisting (MDM-native controls, Santa, AppLocker, WDAC or similar).
• Strong knowledge of OS security and hardening frameworks (CIS, NIST, Apple platform security).
• Good understanding of Microsoft Entra ID, Conditional Access and Zero Trust applied to devices.
• Scripting skills in PowerShell, Python or Bash; familiarity with REST APIs and Microsoft Graph.
• Familiarity with ISO 27001, SOC 2 or ITGC controls and audit evidence.
• Ability to work with Engineering and Product teams and communicate clearly with senior stakeholders. Fluent English; Spanish is a plus.
• Nice to have: DEX tools experience, Microsoft Purview, or certifications (e.g. MD-102, SC-300, Jamf Certified, GIAC, CISSP, Security+).

Please apply with a copy of your CV in English.

We are the pioneers and trailblazers of a global IT Market Category (DEX) that is shaping the future of how the world works, giving our customers’ IT Teams total digital visibility across their enterprise. Our innovative solutions integrate real-time analytics, automation, and employee feedback across all endpoints. This enables our IT …