Job Description

We are looking for an Endpoint Security Engineer to own the security of Nexthink’s corporate endpoint estate: roughly 1,200 devices (550 macOS, 650 Windows) managed through Microsoft Intune and Jamf. You will turn endpoint security from a set of point controls into a measurable, continuously improving program covering what runs on our devices, how quickly we patch them, and how we prove it to auditors.

This is a hands-on role at a pivotal moment, as we build out a dedicated security function. Your first priorities include application baselines and allowlisting, a formal application lifecycle from approval to removal, and stronger vulnerability and compliance posture across both platforms. As a company that sells digital employee experience, we expect security that protects people without getting in their way.

Key Responsibilities

Endpoint Hardening

- Define and maintain security baselines for macOS and Windows (CIS or equivalent), delivered through Intune and Jamf.
- Own hardening standards: disk encryption, firewall, local admin removal and privilege management.
- Evaluate endpoint security tooling and steer vendors while keeping internal ownership of design.

Application Control & Software Governance

- Design and roll out application allowlisting using MDM-native capabilities and/or tools such as Santa, with developer-friendly exception models for Engineering and Product.
- Build and maintain the software and binary inventory: discover, classify and risk-rate applications, and define baselines from the results.
- Run remediation campaigns for unauthorized or high-risk software, from communication to uninstallation and verification.
- Operate the application lifecycle process end to end: request, security review, deployment,



monitoring and retirement.

Vulnerability & Patch Management

- Own endpoint vulnerability management: scanning, risk-based prioritization and remediation tracking against SLAs.
- Define patching and update rings for OS and third-party applications with EUC across macOS and Windows.
- Drive remediation of critical and zero-day vulnerabilities and report on exposure and performance to Security leadership.

Zero Trust & Data Protection

- Partner with IAM and Security to enforce device compliance and device trust in Conditional Access.
- Support endpoint data protection controls (e.g. Microsoft Purview DLP, USB and removable media controls) and hardware-backed authentication such as passkeys and security keys.

Compliance & Reporting

- Document endpoint controls and maintain automated evidence for ISO 27001, SOC 2 and ITGC audits.
- Turn security posture into clear metrics for IT leadership, Security and Finance.

Automation & Digital Employee Experience

- Automate security operations with PowerShell, Python, shell scripting, Microsoft Graph and the Jamf and Intune APIs.
- Use Nexthink’s own DEX platform to measure endpoint health and the employee impact of security changes, and build self-service remediation to reduce tickets.

Primary Metrics

- Device compliance and security baseline adherence (macOS and Windows)
- Mean time to remediate critical and high vulnerabilities, against SLA
- Patch and OS currency against SLAs
- Application control coverage and share of unclassified binaries
- Unauthorized or high-risk application count, and time to remediate
- Standing local admin count
- Endpoint-related audit findings and evidence automation coverage
- Employee experience impact of security controls (Nexthink DEX score)

📌 Endpoint Security Engineer (Madrid)
🏢 Nexthink
📍 Madrid