Experteer Overview

In this role you will own and advance Nexthink's endpoint security program across macOS and Windows, leveraging Intune and Jamf to deliver measurable hardening, application control, and vulnerability response. You’ll partner with Engineering and Product to implement developer-friendly controls while maintaining strong compliance posture for audits.

The role blends hands-on engineering with security leadership at a pivotal growth moment. You’ll shape a security program that protects people without slowing their work, within a cross-functional team.

Compensaciones / Beneficios

- Define and maintain macOS and Windows security baselines (CIS or equivalent) delivered via Intune and Jamf
- Own hardening standards including disk encryption, firewall, local admin removal, and privilege management
- Evaluate endpoint security tooling and guide vendor decisions while preserving internal design ownership
- Design and roll out application allowlisting using MDM-native controls or tools like Santa with developer-friendly exceptions
- Inventory, classify, and risk-rate software; establish baselines from results
- Lead remediation campaigns for unauthorized or high-risk software including communications and uninstallation
- Manage end-to-end application lifecycle: request, security review, deployment, monitoring, retirement
- Oversee endpoint vulnerability management: scanning, risk-based prioritization, remediation tracking against SLAs
- Define patching schemes and update rings for OS and third-party apps across macOS and Windows
- Drive remediation of critical/zero-day vulnerabilities and report exposure to leadership




- Collaborate with IAM/Security to enforce device compliance and device trust in Conditional Access
- Support endpoint data protection controls (e.g., Microsoft Purview DLP, USB controls) and hardware-backed authentication
- Document endpoint controls and automate evidence for ISO 27001, SOC 2, and ITGC audits
- Turn security posture into clear metrics for IT leadership, Security and Finance
- Automate security operations with Power Shell, Python, shell scripting, Microsoft Graph, and Jamf/Intune APIs
- Utilize Nexthink DEX platform to measure endpoint health and build self-service remediation

Responsabilidades

- 5+ years in endpoint security or security engineering with a strong security focus
- Hands-on experience securing macOS and Windows at scale using Intune and Jamf
- Experience with vulnerability management tooling and remediation workflows
- Experience with application control and allowlisting (MDM-native controls, Santa, App Locker, WDAC)
- Strong knowledge of OS security/hardening frameworks (CIS, NIST, Apple platform security)
- Understanding of Microsoft Entra ID, Conditional Access and device Zero Trust concepts
- Scripting in Power Shell, Python, or Bash; familiar with REST APIs and Microsoft Graph
- Familiarity with ISO 27001, SOC 2 or ITGC controls and audit evidence
- Ability to collaborate with Engineering and Product; clear communication with senior stakeholders
- Fluent English; Spanish a plus
- Nice to have: DEX tools, Microsoft Purview, or certifications (MD-102, SC-300, Jamf Certified, GIAC, CISSP, Security+)

Requisitos principales

- Permanent contract
- Private health insurance
- Hybrid work model
- Unlimited vacation
- Versátil hours
- Gym subsidy

📌 Endpoint Security Engineer (Madrid)
🏢 Nexthink
📍 Madrid