Endpoint Security Engineer

Vitol is seeking an Endpoint Security Engineer to join its Technology department. The role is  accountable for protecting Vitol's Endpoints (Desktops, Laptops, VDIs, Mobiles & Tablets) and  the Microsoft 365 workplace around them, across our worldwide operations.  The Endpoint Security Engineer will engineer and run endpoint protection with products such as  CrowdStrike, Palo Alto, Tanium, and device management and compliance with  Intune/AirWatch/Workspace One, and Microsoft 365 Security.  The role also plays a central part in Vitol's transformation and adoption of cloud-native device  management such as Microsoft Intune & Workspace One  The Endpoint Security Engineer will work closely with the CISO organization, the local IT Support  & infrastructure teams, and the Cloud & Network teams.  Key areas of responsibility for the Endpoint Security Engineer include:  • Endpoint Protection: Deploy, configure, and maintain Vitol’s security stack across the  estate, covering sensor rollout and health, prevention and detection policies, exclusions,  device control, and related settings.  • Hardening & Patching: Maintain hardening baselines, disk encryption, patching, and  vulnerability remediation across Windows, macOS, and mobile devices. Ensure Attack  surface reduction rules are applied across all devices.  • Device Management: Engineer Intune for security, including compliance policies,  configuration profiles, security baselines, app protection, and modern device provisioning.  • Intune Migration: Contribute to the rollout of Intune, making sure security controls carry over  and improved, insuring configuration-as-code for Intune & conditional access  • Identity & Access: Ensure Entra ID controls defined by the IAM team are well implemented  and that tie access to device and identity health, including Conditional Access, device  compliance, and multi-factor authentication.  • Microsoft 365 Security: Apply Microsoft 365 security and compliance controls relevant to  endpoints, such as data loss prevention and information protection.  • Integration: Integrate EDR and EPP systems with Intune and Entra ID so that device risk  informs access decisions.  • Monitoring & Reporting: Monitor endpoint security posture, and incidents with security  operations, drive remediation to closure, and assess exposure to new threats.  • Automation: Automate deployment, compliance checks, and reporting with PowerShell and  the Microsoft Graph API.  • Standards & Compliance: Maintain endpoint security standards, operating procedures, and  documentation, and support audits aligned with ISO 27001, NIST, and CIS.  • DLP: Working in close collaboration with Cyber Security & Assurance to ensure proper  deployment of DLP rules and sensitivity labels across devices.  • Education: Undergraduate or postgraduate degree in a technical discipline (Computer  Science, Engineering, Information Security, or a related field), or equivalent experience.  • Endpoint Security Experience: 5+ years of experience engineering endpoint security in an  enterprise environment.  • EDR/EPP: Strong hands-on experience, covering deployment, policy design, tuning, and  investigation with main EDR tools in the market such as CrowdStrike, Palo Alto, M365  Security  • Microsoft Intune: Strong hands-on experience across Windows, macOS, iOS, and Android.  • Entra ID: Solid knowledge of Entra ID, including Conditional Access, device identity, and  multi-factor authentication.  • Microsoft 365/DLP: Very good knowledge of Microsoft 365 security and compliance  capabilities, Microsoft Pureview for retention policies and DLP.  • Hardening & Vulnerability Management: Strong grasp of endpoint hardening, encryption,  patching, and vulnerability management