Endpoint Security Engineer

We are looking for an Endpoint Security Engineer to own the security of Nexthink’s corporate endpoint estate: roughly 1,200 devices (550 macOS, 650 Windows) managed through Microsoft Intune and Jamf. You will turn endpoint security from a set of point controls into a measurable, continuously improving program covering what runs on our devices, how quickly we patch them, and how we prove it to auditors. This is a hands-on role at a pivotal moment, as we build out a dedicated security function. Your first priorities include application baselines and allowlisting, a formal application lifecycle from approval to removal, and stronger vulnerability and compliance posture across both platforms. As a company that sells digital employee experience, we expect security that protects people without getting in their way. Key Responsibilities Endpoint Hardening • Define and maintain security baselines for macOS and Windows (CIS or equivalent), delivered through Intune and Jamf. • Own hardening standards: disk encryption, firewall, local admin removal and privilege management. • Evaluate endpoint security tooling and steer vendors while keeping internal ownership of design. Application Control & Software Governance • Design and roll out application allowlisting using MDM-native capabilities and/or tools such as Santa, with developer-friendly exception models for Engineering and Product. • Build and maintain the software and binary inventory: discover, classify and risk-rate applications, and define baselines from the results. • Run remediation campaigns for unauthorized or high-risk software, from communication to uninstallation and verification. • Operate the application lifecycle process end to end: request, security review, deployment, monitoring and retirement. Vulnerability & Patch Management • Own endpoint vulnerability management: scanning, risk-based prioritization and remediation tracking against SLAs. • Define patching and update rings for OS and third-party applications with EUC across macOS and Windows. • Drive remediation of critical and zero-day vulnerabilities and report on exposure and performance to Security leadership. Zero Trust & Data Protection • Partner with IAM and Security to enforce device compliance and device trust in Conditional Access. • Support endpoint data protection controls (e.g. Microsoft Purview DLP, USB and removable media controls) and hardware-backed authentication such as passkeys and security keys. Compliance & Reporting • Document endpoint controls and maintain automated evidence for ISO 27001, SOC 2 and ITGC audits. • Turn security posture into clear metrics for IT leadership, Security and Finance. Automation & Digital Employee Experience • Automate security operations with PowerShell, Python, shell scripting, Microsoft Graph and the Jamf and Intune APIs. • Use Nexthink’s own DEX platform to measure endpoint health and the employee impact of security changes, and build self-service remediation to reduce tickets. Primary Metrics • Device compliance and security baseline adherence (macOS and Windows) • Mean time to remediate critical and high vulnerabilities, against SLA • Patch and OS currency against SLAs • Application control coverage and share of unclassified binaries • Unauthorized or high-risk application count, and time to remediate • Standing local admin count • Endpoint-related audit findings and evidence automation coverage • Employee experience impact of security controls (Nexthink DEX score) • 5+ years in endpoint security, security engineering, or end-user computing with a strong security focus. • Hands-on experience securing macOS and Windows at scale with Microsoft Intune and Jamf (or equivalent). • Practical experience with vulnerability management tooling