SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Nexthink is seeking an Endpoint Security Engineer to own the security of the company's corporate endpoint estate of approximately 1,200 devices (550 macOS, 650 Windows) managed through Microsoft Intune and Jamf. This is a hands-on role at a pivotal moment as Nexthink builds out a dedicated security function. You will transform endpoint security from isolated point controls into a measurable, continuously improving program covering device hardening, application governance, vulnerability management, compliance, and employee experience.
Key Responsibilities:
Endpoint Hardening: Define and maintain security baselines for macOS and Windows using CIS or equivalent standards, delivered through Intune and Jamf. Own hardening standards including disk encryption, firewall configuration, local admin removal, and privilege management. Evaluate and steer endpoint security tooling while maintaining internal ownership of design.
Application Control & Software Governance: Design and deploy application allowlisting using MDM-native capabilities and tools such as Santa, with developer-friendly exception models. Build and maintain software and binary inventory through discovery, classification, and risk-rating. Run remediation campaigns for unauthorized or high-risk software. Operate the complete application lifecycle from request through security review, deployment, monitoring, and retirement.
Vulnerability & Patch Management: Own endpoint vulnerability management including scanning, risk-based prioritization, and remediation tracking against SLAs. Define patching and update rings for OS and third-party applications across macOS and Windows. Drive remediation of critical and zero-day vulnerabilities and report on exposure and performance to Security leadership.
Zero Trust & Data Protection: Partner with IAM and Security teams to enforce device compliance and device trust in Conditional Access. Support endpoint data protection controls such as Microsoft Purview DLP, USB and removable media controls, and hardware-backed authentication including passkeys and security keys.
Compliance & Reporting: Document endpoint controls and maintain automated evidence for ISO 27001, SOC 2, and ITGC audits. Convert security posture into clear metrics for IT leadership, Security, and Finance.
Automation & Digital Employee Experience: Automate security operations using PowerShell, Python, shell scripting, Microsoft Graph, and Jamf and Intune APIs. Leverage Nexthink's own DEX platform to measure endpoint health and employee impact of security changes, and build self-service remediation to reduce tickets.
Primary success metrics include device compliance and security baseline adherence, mean time to remediate critical and high vulnerabilities against SLA, patch and OS currency, application control coverage, unauthorized application count and remediation time, local admin count, audit findings, and employee experience impact.
Requirements:
- 5+ years in endpoint security, security engineering, or end-user computing with strong security focus
- Hands-on experience securing macOS and Windows at scale with Microsoft Intune and Jamf (or equivalent)
- Practical experience with vulnerability management tooling, prioritization, and remediation workflows
- Experience with application control and allowlisting (MDM-native controls, Santa, AppLocker, WDAC, or similar)
- Strong knowledge of OS security and hardening frameworks (CIS, NIST, Apple platform security)
- Good understanding of Microsoft Entra ID, Conditional Access, and Zero Trust applied to devices
- Scripting skills in PowerShell, Python, or Bash; familiarity with REST APIs and Microsoft Graph
- Familiarity with ISO 27001, SOC 2, or ITGC controls and audit evidence
- Ability to work with Engineering and Product teams and communicate clearly with senior stakeholders
- Fluent English; Spanish is a plus
- Nice to have: DEX tools experience, Microsoft Purview, or certifications (MD-102, SC-300, Jamf Certified, GIAC, CISSP, Security+)
