{"id":2500849,"url":"https://alion.io/job/securesafe-it-systems-security-engineer","title":"IT Systems & Security Engineer","company":{"id":1941507,"name":"SecureSafe","domain":"securesafe.com","url":"https://alion.io/company/securesafe","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"HiBob","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Lisbon, Portugal"],"countries":["PT"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":32000,"max_usd":85000,"period":"year","method":"role_country_seniority_unknown","sample_n":26},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Confluence","optional":false},{"name":"DHCP","optional":false},{"name":"DNS","optional":false},{"name":"GitLab","optional":false},{"name":"ITIL","optional":false},{"name":"Jira","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Nessus","optional":false},{"name":"OneDrive","optional":false},{"name":"SharePoint","optional":false},{"name":"SIEM","optional":false},{"name":"VPN","optional":false},{"name":"Windows","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-04-14T09:00:11Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-15T01:13:53Z","board_verified":true,"closed_at":null,"days_open":183,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":183},"description":"We are hiring an IT Systems & Security Engineer to strengthen the stability, security, and efficiency of our internal IT services. This role blends hands-on systems engineering with security operations. You will operate and improve endpoint security and device management, administer Microsoft 365, run vulnerability management, and enhance monitoring/SIEM workflows.\nA core expectation of this position is continuous optimization of our IT and security operations: reducing manual work through automation, lowering operational cost where possible, and improving response times and service quality for employees.\nYou will work closely with the CISO and act as Deputy to the CISO during planned absences (e.g., holidays), ensuring operational continuity and effective decision-making.\nResponsibilities\n1) Endpoint Security Operations (Microsoft Defender)\nOperate Defender day-to-day: monitor alerts, investigate incidents, tune policies, reduce noise, and improve detection quality.\n\nSupport security incident handling: triage, containment coordination, evidence collection, remediation follow-up, and lessons learned.\n\nImprove endpoint security posture via policy hardening, baselining, and measurable reduction of repeated issues.\n\n 2) Microsoft 365 Administration (Entra ID, Intune, Exchange, Teams, SharePoint/OneDrive)Administer Microsoft 365 services with a focus on security, reliability, and operational hygiene.\n\nMaintain access governance: joiner/mover/leaver lifecycle, role assignments, privileged access patterns, and conditional access support (where applicable).\n\nImprove identity and device-based controls in partnership with the CISO (e.g., MFA coverage, device compliance gates, administrative separation).\n\n 3) Device Management & Compliance (Apple & Windows)Manage endpoint lifecycle and compliance across Apple and Windows fleets.\n\nAdminister JAMF for macOS (profiles, deployments, compliance reporting, hardening).\n\nManage Windows endpoints primarily through Intune (configuration, application deployment, compliance, configuration baselines).\n\nStandardize and streamline onboarding/offboarding and device replacement processes.\n\n 4) Vulnerability Management (Nessus)Run and improve vulnerability scanning coverage, schedules, and reporting.\n\nPrioritize remediation by risk and business impact; track closure with clear ownership and deadlines.\n\nEstablish durable reporting cadence and measurable remediation performance.\n\n 5) SIEM / Logging / Monitoring (ELK / SIEM)Improve SIEM effectiveness: ingestion health, source coverage, dashboards, alerting, and correlation across endpoint and infrastructure telemetry.\n\nHelp operationalize detection use cases (high-signal alerts, playbooks, reporting that supports decision-making).\n\nProduce concise operational reporting for stakeholders (security posture, trends, improvements, key risks).\n\n 6) Internal Tooling & Service Delivery (Atlassian, GitLab)Operate and improve Jira Service Management/Confluence workflows: queues, SLAs, request types, automation rules, and documentation standards.\n\nSupport GitLab access and enablement from an IT/security operations perspective (e.g., identity, access controls, user lifecycle), as applicable.\n\nEnsure IT services are reliable, measurable, and continuously improving.\n\n 7) Secure Enablement of AI in the CompanyEnable and support secure use of AI tools and workflows across the company in collaboration with the CISO and key stakeholders.\n\nHelp define and implement practical guardrails (approved tools, data handling rules, access controls, logging/monitoring considerations, user guidance).\n\nSupport employees with secure adoption: documentation, onboarding guidance, and pragmatic reviews of new AI use cases.\n\n 8) Automation, Optimization, and Cost Discipline (Mandate Across the Role)Identify and implement automation opportunities (e.g., identity/device lifecycle, ticket workflows, alert triage, reporting).\n\nReduce operational friction and manual work while improving service speed and quality.\n\nMaintain cost awareness: rationalize tooling/configurations where appropriate, reduce waste, and improve vendor/service ownership clarity.\n\n9) Vendors, Procurement Support, and Operational ContinuityCoordinate with suppliers for hardware/services: delivery tracking, escalation paths, renewal visibility, and operational performance issues.\n\nMaintain runbooks and operational procedures to ensure resilience and audit readiness.\n\nAct as Deputy to the CISO during absences: maintain day-to-day security operations, coordinate incident response activities, and escalate appropriately.\n\nProvide operational leadership as needed to keep internal IT and security services stable and responsive.\n\nHow we evaluate success (first 3-6 months)\nDefender operations: triage workflow is consistent; alert noise is reduced; repeated endpoint issues decrease; incident handling is timely and well-documented.\n\nM365 / Intune / JAMF: device compliance is reliable; onboarding/offboarding is smooth and measurable; admin and access hygiene is improved.\n\nVulnerability management: scanning coverage is consistent; remediation tracking is risk-driven; clear ownership and closure cadence is established.\n\nSIEM / visibility: ingestion stability improves; dashboards and alerts become more actionable; stakeholders get concise, useful reporting.\n\nOptimization: multiple tangible automation/standardization improvements delivered that reduce manual work, reduce cycle times for employee requests, and/or reduce operational costs.\n\nDeputy coverage: operational continuity is demonstrably strong during CISO absence, with appropriate escalation and decision-making.\n\nRequirements\nStrong hands-on experience with Microsoft 365 administration, including Entra ID and Intune.\n\nPractical experience operating Microsoft Defender (alert triage, investigations, policy tuning).\n\nProven endpoint management across macOS and Windows in a business environment.\n\nWorking knowledge of JAMF administration (profiles, policies, deployments, compliance reporting).\n\nWorking knowledge of vulnerability management with Nessus (or equivalent).\n\nFamiliarity with SIEM/logging concepts (ELK and/or other SIEM): ingestion, dashboards, alerting, operational improvement.\n\nSolid network fundamentals relevant to IT security (DNS/DHCP/VPN, segmentation concepts, troubleshooting).\n\nStrong documentation discipline (access management, operational procedures, incident notes).\n\nAbility to operate effectively in ticketed environments and manage priorities (ITIL-inspired practices are a plus).\n\nDemonstrable continuous-improvement mindset: simplify, automate, standardize, measure outcomes; bias for reducing manual effort, lowering cost, and improving response times.\n\nHands-on exposure to AI tools and workflows, with the ability to support secure, practical adoption in a business environment (e.g., testing and enabling use cases, understanding risks around data handling, and contributing to user guidance/guardrails).\n\n Certifications (required or obtained within the first 6-12 months)CompTIA Security+ (or equivalent baseline security certification/competence).\n\nCompTIA Network+ (or equivalent demonstrated networking competence).\n\n Nice to have (certifications)Microsoft certifications: SC-200 (Security Operations Analyst), SC-300 (Identity & Access Administrator), MD-102 (Endpoint Administrator), MS-102 (Microsoft 365 Administrator) or equivalents.\n\nJamf certification: Jamf Certified Tech / Admin (or current Jamf certification track).\n\nITIL Foundation (service management discipline).\n\nSIEM/security analytics training or vendor certifications (helpful, not required).\n\n Nice to have (skills/experience)Automation/scripting (PowerShell, Bash, Python) applied to IT/security operations.\n\nExperience improving SIEM detection use cases and telemetry correlation.\n\nExperience in regulated environments (audit readiness, investigations, evidence handling).\n\nExperience translating security requirements into pragmatic employee guidance (policies, playbooks, enablement).\n\nBenefits\nCompetitive Salary.\nHybrid Work Model: Enjoy the flexibility of remote work while staying connected with at least 40% of your time spent in our vibrant Lisbon office.\n25 Days of Vacation: Recharge and thrive with above-market holiday time, reflecting our people-first approach to work-life balance.\nBi-Annual International Retreats: Collaborate, relax, and explore at company offsites in beautiful locations like Switzerland, Italy, and beyond.\nEmpowered to Make an Impact: Every voice matters-you're encouraged to drive improvements, contribute ideas, and create real value from day one.\nLearn from the Best: Grow your skills in a high-performing, international team of experienced and talented professionals.\nDelicious Perks: Enjoy free lunches, snacks, and drinks daily-because fuel matters.\nMeal allowance, health insurance coverage, and public transportation allowance.\n Work for a company committed to sustainability -our data centers operate climate-neutral.","description_format":"text","description_chars":9024,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance","Hybrid work","Insurance coverage"],"hiring_locations":[{"name":"Portugal","iso":"PT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Energy & Utilities","Financial Services","Government"],"lifecycle":[{"event":"open","at":"2026-10-14T05:48:55Z"}],"visa":[],"liveness":{"score":7,"band":"cold","label":"Long shot","p_open":1,"p_active":0.248,"p_room":0.28,"age_days":182,"expected_fill_days":67,"reasons":["conf:0","win:tail","crowd:"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/securesafe-it-systems-security-engineer","json_url":"https://alion.io/job/securesafe-it-systems-security-engineer.json","meta":{"generated_at":"2026-10-15T01:39:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2293,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1941507},"rest":"https://alion.io/mcp/rest/get_company?id=1941507"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsecuresafe-it-systems-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsecuresafe-it-systems-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsecuresafe-it-systems-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/securesafe-it-systems-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsecuresafe-it-systems-security-engineer"}]}