{"id":2453030,"url":"https://alion.io/job/nexthink-endpoint-security-engineer","title":"Endpoint Security Engineer","company":{"id":1613,"name":"Nexthink","domain":"nexthink.com","url":"https://alion.io/company/nexthink","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":75,"open_postings":11,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":39,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Madrid, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":51000,"max_usd":120000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":1891},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"DLP","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"SOC 2","optional":false},{"name":"Windows","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-10-13T13:34:40Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-14T03:08:19Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Nexthink is the leader in digital employee experience management software. The company provides IT leaders with unprecedented insight allowing them to see, diagnose and fix issues at scale impacting employees anywhere, with any application or network, before employees notice the issue. As the first solution to allow IT to progress from reactive problem solving to proactive optimization, Nexthink enables its more than 1,500 customers to provide better digital experiences to more than 25+ million employees. Dual headquartered in Lausanne, Switzerland and Boston, Massachusetts, Nexthink has 9 offices worldwide.\nWe are looking for an Endpoint Security Engineer to own the security of Nexthink’s corporate endpoint estate: roughly 1,200 devices (550 macOS, 650 Windows) managed through Microsoft Intune and Jamf. You will turn endpoint security from a set of point controls into a measurable, continuously improving program covering what runs on our devices, how quickly we patch them, and how we prove it to auditors.\nThis is a hands-on role at a pivotal moment, as we build out a dedicated security function. Your first priorities include application baselines and allowlisting, a formal application lifecycle from approval to removal, and stronger vulnerability and compliance posture across both platforms. As a company that sells digital employee experience, we expect security that protects people without getting in their way.\nKey Responsibilities\nEndpoint Hardening\nDefine and maintain security baselines for macOS and Windows (CIS or equivalent), delivered through Intune and Jamf.\nOwn hardening standards: disk encryption, firewall, local admin removal and privilege management.\nEvaluate endpoint security tooling and steer vendors while keeping internal ownership of design.\nApplication Control & Software Governance\nDesign and roll out application allowlisting using MDM-native capabilities and/or tools such as Santa, with developer-friendly exception models for Engineering and Product.\nBuild and maintain the software and binary inventory: discover, classify and risk-rate applications, and define baselines from the results.\nRun remediation campaigns for unauthorized or high-risk software, from communication to uninstallation and verification.\nOperate the application lifecycle process end to end: request, security review, deployment, monitoring and retirement.\nVulnerability & Patch Management\nOwn endpoint vulnerability management: scanning, risk-based prioritization and remediation tracking against SLAs.\nDefine patching and update rings for OS and third-party applications with EUC across macOS and Windows.\nDrive remediation of critical and zero-day vulnerabilities and report on exposure and performance to Security leadership.\nZero Trust & Data Protection\nPartner with IAM and Security to enforce device compliance and device trust in Conditional Access.\nSupport endpoint data protection controls (e.g. Microsoft Purview DLP, USB and removable media controls) and hardware-backed authentication such as passkeys and security keys.\nCompliance & Reporting\nDocument endpoint controls and maintain automated evidence for ISO 27001, SOC 2 and ITGC audits.\nTurn security posture into clear metrics for IT leadership, Security and Finance.\nAutomation & Digital Employee Experience\nAutomate security operations with PowerShell, Python, shell scripting, Microsoft Graph and the Jamf and Intune APIs.\nUse Nexthink’s own DEX platform to measure endpoint health and the employee impact of security changes, and build self-service remediation to reduce tickets.\nPrimary Metrics\nDevice compliance and security baseline adherence (macOS and Windows)\nMean time to remediate critical and high vulnerabilities, against SLA\nPatch and OS currency against SLAs\nApplication control coverage and share of unclassified binaries\nUnauthorized or high-risk application count, and time to remediate\nStanding local admin count\nEndpoint-related audit findings and evidence automation coverage\nEmployee experience impact of security controls (Nexthink DEX score)\n 5+ years in endpoint security, security engineering, or end-user computing with a strong security focus.\nHands-on experience securing macOS and Windows at scale with Microsoft Intune and Jamf (or equivalent).\nPractical experience with vulnerability management tooling, prioritization and remediation workflows.\nExperience with application control and allowlisting (MDM-native controls, Santa, AppLocker, WDAC or similar).\nStrong knowledge of OS security and hardening frameworks (CIS, NIST, Apple platform security).\nGood understanding of Microsoft Entra ID, Conditional Access and Zero Trust applied to devices.\nScripting skills in PowerShell, Python or Bash; familiarity with REST APIs and Microsoft Graph.\nFamiliarity with ISO 27001, SOC 2 or ITGC controls and audit evidence.\nAbility to work with Engineering and Product teams and communicate clearly with senior stakeholders. Fluent English; Spanish is a plus.\nNice to have: DEX tools experience, Microsoft Purview, or certifications (e.g. MD-102, SC-300, Jamf Certified, GIAC, CISSP, Security+).\nPlease apply with a copy of your CV in English.\n We are the pioneers and trailblazers of a global IT Market Category (DEX) that is shaping the future of how the world works, giving our customers’ IT Teams total digital visibility across their enterprise. Our innovative solutions integrate real-time analytics, automation, and employee feedback across all endpoints. This enables our IT teams to solve complex technical challenges, create ever more productive workplaces, and deliver happy, satisfied employees in the digital workplace.\nWith over 1000 employees across 5 continents, Nexthink operates as One Team, connecting, collaborating and innovating to continuously grow. We call our employees ‘Nexthinkers’ and our commitment to diversity, inclusion, and equity is second to none. We currently have over 75 nationalities working with us, from all cultures and backgrounds, speaking many different languages.\nIf you are looking for a change and like a nice atmosphere, lots of challenges, and having fun while working, this is a great opportunity for you! Check what we offer:\n Permanent Contract and a competitive compensation package. \n Amazing centrally located offices near the Bernabeu Stadium. \n Private Health Insurance (Sanitas) and daily meal vouchers of 11 EUR . \n Hybrid work model balancing office and remote work. \n Flexible Hours and unlimited vacation (employees have unlimited paid time off on top of the 23 days of holidays we offer) plus 3 company-paid volunteer days. \n Up to 25 EUR per month for a gym subscription. \n Flexible compensation plan for childcare & public transportation. \n Reimbursement of up to 50% of the cost of English & Spanish classes. \n Fresh fruit, cookies, and soft drinks in the office. \n Regular company and team events like Pizza talks, Team Building activities, Christmas parties, hosting Meetups at the office and more! \n Bonuses for referring successful hires after three months of continuous employment.","description_format":"text","description_chars":7072,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Equity","Health insurance","Hybrid work"],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Vulnerability Management","IT Service & Asset Management","Observability & APM"],"lifecycle":[{"event":"open","at":"2026-10-13T15:21:03Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":0,"expected_fill_days":39,"reasons":["conf:3","stale_co","win:early"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/nexthink-endpoint-security-engineer","json_url":"https://alion.io/job/nexthink-endpoint-security-engineer.json","meta":{"generated_at":"2026-10-14T07:50:30Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8978,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1613},"rest":"https://alion.io/mcp/rest/get_company?id=1613"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnexthink-endpoint-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnexthink-endpoint-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnexthink-endpoint-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nexthink-endpoint-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnexthink-endpoint-security-engineer"}]}