Endpoint Security Engineer

Nexthink is the leader in digital employee experience management software, serving more than 1,500 customers and 25+ million employees. Dual headquartered in Lausanne, Switzerland and Boston, Massachusetts, with 9 offices worldwide.

• Define and maintain security baselines for macOS and Windows (CIS or equivalent), delivered through Intune and Jamf
• Own hardening standards: disk encryption, firewall, local admin removal and privilege management
• Design and roll out application allowlisting using MDM-native capabilities and/or tools such as Santa
• Build and maintain the software and binary inventory: discover, classify and risk-rate applications
• Run remediation campaigns for unauthorized or high-risk software
• Operate the application lifecycle process end to end: request, security review, deployment, monitoring and retirement
• Own endpoint vulnerability management: scanning, risk-based prioritization and remediation tracking against SLAs
• Define patching and update rings for OS and third-party applications across macOS and Windows
• Drive remediation of critical and zero-day vulnerabilities
• Partner with IAM and Security to enforce device compliance and device trust in Conditional Access
• Support endpoint data protection controls (e.g. Microsoft Purview DLP, USB and removable media controls)
• Document endpoint controls and maintain automated evidence for ISO 27001, SOC 2 and ITGC audits
• Automate security operations with PowerShell, Python, shell scripting, Microsoft Graph and the Jamf and Intune APIs

• Experience owning security of corporate endpoint estate (macOS and Windows)
• Hands-on experience with Microsoft Intune and Jamf
• Knowledge of CIS benchmarks and endpoint hardening standards
• Experience with application allowlisting and software governance
• Experience with endpoint vulnerability and patch management
• Experience with PowerShell, Python, shell scripting, Microsoft Graph, Jamf and Intune APIs
• Experience with compliance frameworks ISO 27001, SOC 2, ITGC

• Hybrid work
• Full-time position
• Department: Information Technology