Endpoint Security Engineer

We are looking for an Endpoint Security Engineer to own the security of Nexthink’s corporate endpoint estate: roughly 1,200 devices (550 macOS, 650 Windows) managed through Microsoft Intune and Jamf. You will turn endpoint security from a set of point controls into a measurable, continuously improving program covering what runs on our devices, how quickly we patch them, and how we prove it to auditors.

This is a hands-on role at a pivotal moment, as we build out a dedicated security function. Your first priorities include application baselines and allowlisting, a formal application lifecycle from approval to removal, and stronger vulnerability and compliance posture across both platforms. As a company that sells digital employee experience, we expect security that protects people without getting in their way.

Key Responsibilities

Endpoint Hardening

• Define and maintain security baselines for macOS and Windows (CIS or equivalent), delivered through Intune and Jamf.
• Own hardening standards: disk encryption, firewall, local admin removal and privilege management.
• Evaluate endpoint security tooling and steer vendors while keeping internal ownership of design.
Application Control & Software Governance

• Design and roll out application allowlisting using MDM-native capabilities and/or tools such as Santa, with developer-friendly exception models for Engineering and Product.
• Build and maintain the software and binary inventory: discover, classify and risk-rate applications, and define baselines from the results.
• Run remediation campaigns for unauthorized or high-risk software, from communication to uninstallation and verification.
• Operate the application lifecycle process end to end: request, security review, deployment, monitoring and retirement.
Vulnerability & Patch Management

• Own endpoint vulnerability management: scanning, risk-based prioritization and remediation tracking against SLAs.
• Define patching and update rings for OS and third-party applications with EUC across macOS and Windows.
• Drive remediation of critical and zero-day vulnerabilities and report on exposure and performance to Security leadership.
Zero Trust & Data Protection

• Partner with IAM and Security to enforce device compliance and device trust in Conditional Access.
• Support endpoint data protection controls (e.g. Microsoft Purview DLP, USB and removable media controls) and hardware-backed authentication such as passkeys and security keys.
Compliance & Reporting

• Document endpoint controls and maintain automated evidence for ISO 27001, SOC 2 and ITGC audits.
• Turn security posture into clear metrics for IT leadership, Security and Finance.
Automation & Digital Employee Experience

• Automate security operations with PowerShell, Python, shell scripting, Microsoft Graph and the Jamf and Intune APIs.
• Use Nexthink’s own DEX platform to measure endpoint health and the employee impact of security changes, and build self-service remediation to reduce tickets.
Primary Metrics

• Device compliance and security baseline adherence (macOS and Windows)
• Mean time to remediate critical and high vulnerabilities, against SLA
• Patch and OS currency against SLAs
• Application control coverage and share of unclassified binaries
• Unauthorized or high-risk application count, and time to remediate
• Standing local admin count
• Endpoint-related audit findings and evidence automation coverage
• Employee experience impact of security controls (Nexthink DEX score)

Department: Information Technology
Experience Level: Mid-Senior Level