Endpoint Security Engineer

Vitol; Genf; On-site; CHF 120,000 - 170,000; Full time

Job summary

Vitol is seeking an Endpoint Security Engineer to safeguard endpoints (desktops, laptops, VDIs, mobiles) and the Microsoft 365 footprint across global operations.

You will deploy and refine CrowdStrike, Palo Alto, Tanium, and manage device security via Intune, AirWatch, and Workspace One. You will help advance cloud-native device management and collaborate with CISO, IT and Cloud teams.

Qualifications

• 5+ years of endpoint security engineering in an enterprise environment.
• Hands-on experience with EDR/EPP tooling and policy design.
• Strong knowledge of Intune, Entra ID, and M365 security.
• Experience across Windows, macOS, iOS and Android.
• Familiarity with CIS, NIST, and ISO 27001 frameworks.
• Scripting with PowerShell and Graph API.

Responsibilities

• Deploy, configure, and maintain endpoint protection across the estate.
• Maintain hardening baselines, encryption, patching and vulnerability remediation.
• Engineer Intune for security: compliance, profiles, baselines and app protection.
• Migrate and optimize Intune implementations with policy-as-code.
• Implement Entra ID controls: CA, device health, MFA.
• Apply M365 security and DLP controls for endpoints.
• Integrate EDR/EPP with Intune and Entra ID for posture-driven access.
• Monitor security posture and incidents; drive remediation.

Skills

Endpoint security

EDR/EPP

Intune/OS security

Entra ID

Microsoft 365 security

Hardening & patching

Scripting & automation

Security frameworks

Industry knowledge

Languages: English/French

Education

Bachelor's or Master's in CS/Engineering/InfoSec

Tools

CrowdStrike

Palo Alto

Microsoft Intune

Workspace One

AirWatch

Tanium

Entra ID

Microsoft Graph API

PowerShell

SCCM/Configuration Manager

Job description

Company Description

Vitol is a leader in the energy sector with a presence across the spectrum: from oil through to power, renewables and carbon. From 40 offices worldwide, we seek to add value across the energy supply chain, including deploying our scale and market understanding to help facilitate the energy transition. To date, we have committed over $2 billion of capital to renewable projects, and are identifying and developing low-carbon opportunities around the world.

Our people are our business. Talent is precious to us and we create an environment in which individuals can reach their full potential, unhindered by hierarchy. Our team comprises more than 65 nationalities and we are committed to developing and sustaining a diverse work force. Learn more about us here.

Job Description

Vitol is seeking an Endpoint Security Engineer to join its Technology department. The role is accountable for protecting Vitol's Endpoints (Desktops, Laptops, VDIs, Mobiles & Tablets) and the Microsoft 365 workplace around them, across our worldwide operations.

The Endpoint Security Engineer will engineer and run endpoint protection with products such as CrowdStrike, Palo Alto, Tanium, and device management and compliance with Intune/AirWatch/Workspace One, and Microsoft 365 Security.

The role also plays a central part in Vitol's transformation and adoption of cloud-native device management such as Microsoft Intune & Workspace One.

The Endpoint Security Engineer will work closely with the CISO organization, the local IT Support & infrastructure teams, and the Cloud & Network teams.

Key areas of responsibility for the Endpoint Security Engineer include:

• Endpoint Protection: Deploy, configure, and maintain Vitol’s security stack across the estate, covering sensor rollout and health, prevention and detection policies, exclusions, device control, and related settings.
• Hardening & Patching: Maintain hardening baselines, disk encryption, patching, and vulnerability remediation across Windows, macOS, and mobile devices. Ensure Attack surface reduction rules are applied across all devices.
• Device Management: Engineer Intune for security, including compliance policies, configuration profiles, security baselines, app protection, and modern device provisioning.
• Intune Migration: Contribute to the rollout of Intune, making sure security controls carry over and improved, insuring configuration-as-code for Intune & conditional access
• Identity & Access: Ensure Entra ID controls defined by the IAM team are well implemented and that tie access to device and identity health, including Conditional Access, device compliance, and multi-factor authentication.
• Microsoft 365 Security: Apply Microsoft 365 security and compliance controls relevant to endpoints, such as data loss prevention and information protection.
• Integration: Integrate EDR and EPP systems with Intune and Entra ID so that device risk informs access decisions.
• Monitoring & Reporting: Monitor endpoint security posture, and incidents with security operations, drive remediation to closure, and assess exposure to new threats.
• Automation: Automate deployment, compliance checks, and reporting with PowerShell and the Microsoft Graph API.
• Standards & Compliance: Maintain endpoint security standards, operating procedures, and documentation, and support audits aligned with ISO 27001, NIST, and CIS.
• DLP: Working in close collaboration with Cyber Security & Assurance to ensure proper deployment of DLP rules and sensitivity labels across devices.

Qualifications

• Education: Undergraduate or postgraduate degree in a technical discipline (Computer Science, Engineering, Information Security, or a related field), or equivalent experience.
• Endpoint Security Experience: 5+ years of experience engineering endpoint security in an enterprise environment.
• EDR/EPP: Strong hands‑on experience, covering deployment, policy design, tuning, and investigation with main EDR tools in the market such as CrowdStrike, Palo Alto, M365 Security
• Microsoft Intune: Strong hands‑on experience across Windows, macOS, iOS, and Android.
• Entra ID: Solid knowledge of Entra ID, including Conditional Access, device identity, and multi‑factor authentication.
• Microsoft 365/DLP: Very good knowledge of Microsoft 365 security and compliance capabilities, Microsoft Pureview for retention policies and DLP.
• Hardening & Vulnerability Management: Strong grasp of endpoint hardening, encryption, patching, and vulnerability management.
• Scripting & Automation: Experience with PowerShell and the Microsoft Graph API.
• Frameworks: Working knowledge of the CIS, NIST, and ISO 27001 frameworks.
• SCCM & Intune: Experience with SCCM / Configuration Manager, and with migrating from it to Intune, is an advantage.
• Certifications: Microsoft MD-102, SC-200, or SC-300, or CrowdStrike Certified Falcon Administrator (CCFA) or Responder (CCFR), CISSP/ISSEP is an advantage
• Industry: Familiarity with commodity trading or financial services technology environments is an advantage.
• Languages: Fluent English/French

Additional Information

• Analytical & Improvement-Minded: Brings an analytical mindset and a focus on continuous improvement.
• Clear Communicator: Explains security decisions to both technical teams and end users, and documents them well.
• Stakeholder Management: Balances security with a smooth working experience for traders and employees.
• Highly Collaborative: Works well with helpdesk, infrastructure, and security colleagues, and shares knowledge freely.
• Pragmatic & Outcome-Oriented: Prioritizes by risk and sees remediation through to closure.
• Decisive & Action-Oriented: Comfortable setting priorities and delivering at pace in a flat, high-ownership culture.