Endpoint Security Expert

NCIM; Brussel Hoofdstad; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

NCIM in Brussels is seeking a Senior Endpoint Security Expert to manage NATO endpoint security environments, focusing on Trellix products.

You will oversee policy implementation, incident response, and upgrades across Windows endpoints, servers, and VDI. The role requires NATO Secret clearance and a strong ITIL background, with on-site work in Brussels and limited remote work.

Qualifications

• Hands-on Trellix experience in enterprise environments.
• Experience securing Windows endpoints and Windows/Linux servers.
• Familiarity with ITIL-based service management processes.

Responsibilities

• Manage lifecycle of endpoint security products and configurations.
• Lead Trellix product upgrades and deployments across endpoints and servers.
• Support incident response activities and investigate Trellix-related incidents.
• Develop and enforce endpoint security policies and baselines.
• Provide technical guidance on security architecture and engineering decisions.
• Document processes, SOPs and governance practices.

Skills

Trellix expertise

Endpoint security

IT service management (ITIL)

Incident management

Security analysis

Communication

Documentation

Independence

Analytical skills

Tools

Trellix ePolicy Orchestrator (ePO)

Windows & Linux administration

Job description

Duties & Requirements

Position: CSU Brussels – Endpoint Security Expert
Reference Number: C005192
Equivalent NATO Grade: G12
Work Location: Brussels, Belgium
Security Clearance: NATO Secret

1. Main Duties and Responsibilities

The Endpoint Security Expert will be responsible for managing, maintaining and improving NATO's endpoint security environment, with a particular focus on Trellix security products.

Key responsibilities include:

1. Endpoint Security Management

• Manage the complete lifecycle of assigned endpoint security products.
• Maintain and develop security policies, configurations, baselines, exclusions and exceptions.
• Ensure endpoint security solutions are aligned with NATO security requirements and industry best practices.

2. Trellix Product Management

• Manage the full range of Trellix products, including Threat Prevention, Application Control, Host Firewall, Data Loss Prevention (DLP) and Drive Encryption.
• Plan, coordinate and lead Trellix product upgrades at least every two months.
• Deploy upgrades across Windows laptops, workstations, VDI environments, and Windows/Linux servers.

3. Security Operations and Incident Response

• Support incident response activities in collaboration with CSU teams and the Service Desk.
• Investigate and troubleshoot Trellix-related incidents and technical problems.
• Analyse security events, logs, alerts and endpoint data exchanges.
• Perform root cause analysis and resolve performance-related issues.

4. Security Policy Implementation

• Test and implement NATO endpoint security policies.
• Optimise security configurations and policies to balance protection and system performance.
• Manage security exceptions through established approval procedures.

5. Technical Advisory and Collaboration

• Provide technical expertise and guidance on endpoint security architecture and engineering decisions.
• Work closely with IT administrators, security teams and other stakeholders.
• Ensure endpoint configurations meet security standards and operational requirements.

6. Documentation and Continuous Improvement

• Develop and maintain Standard Operating Procedures (SOPs).
• Document technical processes, configurations and operational procedures.
• Contribute to the continuous improvement of endpoint security processes, standards and governance.
• Promote knowledge sharing across technical teams.

2. Required Skills, Knowledge and Experience

• Trellix expertise: Recent hands‑on experience implementing and managing the full range of Trellix products.
• Endpoint security: Strong experience securing Windows endpoints and Windows/Linux servers.
• IT service management: Experience working in complex IT environments and following ITIL processes.
• Incident management: Strong troubleshooting, root cause analysis and problem‑solving capabilities.
• Security analysis: Ability to analyse security events, logs, alerts and endpoint data.
• Communication: Strong communication and coordination skills when working with multiple technical teams.
• Documentation: Ability to produce technical documentation, SOPs and knowledge‑sharing materials.
• Independence: Ability to work autonomously, take ownership and drive technical issues to resolution.
• Analytical skills: Strong analytical and technical assessment capabilities.

3. Contract and Working Conditions

• Requirement number: C005192
• Location: Brussels, Belgium
• NATO grade: G12
• Start date: 7 December 2026
• End date: 30 December 2026
• Total effort: 300 hours
• Working arrangement: 100% on‑site
• Remote work: Limited possibility, approximately 1 day per week
• Security clearance: NATO Secret
• Travel: None
• Working environment: Normal, non-smoking office environment

4. Ideal Candidate Profile

The ideal candidate is a senior Endpoint Security Engineer / Trellix Security Specialist with extensive practical experience managing enterprise endpoint protection solutions in a complex, security‑sensitive IT environment.

The candidate should demonstrate:

• In‑depth knowledge of the Trellix product portfolio.
• Hands‑on experience with Trellix ePolicy Orchestrator (ePO) and endpoint security administration.
• Experience managing security policies across large Windows and Linux environments.
• Proven experience planning and executing enterprise‑wide security product upgrades.
• Strong understanding of endpoint security architecture, incident response and troubleshooting.
• Familiarity with ITIL‑based service management processes.
• Ability to work independently in a NATO or similarly regulated environment.
• Excellent technical documentation and stakeholder communication skills.
• Valid NATO Secret security clearance.

5. Most Important Selection Criteria

Critical technical requirements

The following areas are likely to carry the greatest weight when assessing candidates:

1. Trellix expertise: Demonstrable hands‑on experience across multiple Trellix security products.
2. Enterprise endpoint management: Experience managing Windows endpoints, VDI and Windows/Linux servers.
3. Trellix upgrades: Ability to plan and lead regular product upgrades across a large infrastructure.
4. Security engineering: Experience implementing and optimising endpoint security policies and baselines.
5. Troubleshooting: Strong incident investigation and root cause analysis capabilities.
6. NATO environment: Ability to operate within NATO security requirements, including NATO Secret clearance.

6. Overall Assessment

This is primarily a hands‑on Senior Endpoint Security Engineering role, rather than a general IT support or cybersecurity governance position.

The most suitable candidate would combine:

• Trellix product expertise.
• Enterprise endpoint security engineering.
• Windows and Linux administration.
• Security policy implementation.
• Incident response and operational troubleshooting.
• Technical leadership and documentation.

The strongest differentiator is practical, recent experience managing the complete Trellix security portfolio in a large enterprise environment. General cybersecurity experience alone would not be sufficient.