IT Infrastructure Security Engineer

Nexthink; Deutschland; Hybrid; EUR 33.000 - 49.000; Vollzeit

Benefits dieser Stelle

Hybrid work model

Private Health Insurance (Sanitas)

Meal vouchers €11

Unlimited vacation

Volunteer days

Gym subsidy

Office near Bernabéu

Team events

Zusammenfassung

Nexthink is seeking an Infrastructure Security Engineer to design and operate security controls protecting our corporate infrastructure across non-cloud, cloud, and internal networks.

You will report to the Infrastructure Security Lead, focusing on hardening, patching, cloud posture, and segmentation, with responsibilities spanning Windows, Linux, VMware, AD, IaC, and CI/CD security. Fluency in English is essential; Spanish is a plus.

Qualifikationen

• 4+ years in infrastructure or security engineering, with exposure to both non-cloud and cloud environments.
• Experience hardening Windows Server, Linux, and VMware vSphere.
• Working experience with Active Directory, Group Policy, and Microsoft Entra ID.
• Experience with Azure/AWS security controls.
• Scripting fluency in Python, PowerShell, or Bash.
• Experience with Infrastructure as Code, such as Terraform or Ansible.
• Knowledge of GitHub and GitHub Actions for CI/CD pipelines, with a notion of HashiCorp Vault for secrets management.
• Familiarity with vulnerability management platforms, cloud security certification (Azure/AWS), and ISO/SOC 2 Type 2/FedRAMP exposure are a plus
• Professional level of spoken and written English, Spanish is a plus

Aufgaben

• Engineer and operate security controls protecting Nexthink's corporate infrastructure across non-cloud, cloud, and internal networks.
• Report to Infrastructure Security Lead and drive hardening, patching, cloud posture, and segmentation.
• Contribute to hardening baselines across VM fleet (Windows, Linux).
• Support security controls for Active Directory, Group Policy, and Microsoft Entra ID.
• Participate in patch automation to meet SLA for critical CVEs.
• Contribute to cloud security posture management across Azure and AWS.
• Help implement policy-as-code for cloud configuration baselines and remediation of drift.
• Assist in micro-segmentation policies and trust-model controls.
• Validate east-west traffic and network security compliance.
• Maintain patch, vulnerability, and configuration evidence for audits.
• Coordinate internal and external security audits and gather evidence.
• Track and remediate assigned exceptions and audit findings within timelines.
• Take part in audits and control walkthroughs.

Kenntnisse

Infrastructure security

Cloud security controls

Windows hardening

Linux hardening

Active Directory

Group Policy

Microsoft Entra ID

Azure

AWS

Python

PowerShell

Bash

Terraform

Ansible

GitHub Actions

HashiCorp Vault

Vulnerability management

ISO/SOC 2

English

Spanish

Tools

Terraform

Ansible

GitHub Actions

HashiCorp Vault

Jobbeschreibung

We are looking for an Infrastructure Security Engineer who will engineer and operate the technical security controls protecting Nexthink's corporate infrastructure, spanning non-cloud, cloud, and internal network environments.

You will report to the Infrastructure Security Lead, executing the hardening, patching, cloud posture, and segmentation.

Your main responsibilities will include:

• Contribute to hardening baselines across the VM fleet (Windows, Linux)
• Support security controls and initiative for Active Directory, Group Policy, and Microsoft Entra ID
• Take part in patch automation, helping drive emergency patching coverage to SLA for critical CVEs
• Contribute to cloud security posture management across Azure and AWS
• Help implement and maintain policy-as-code for cloud configuration baselines, and support remediation of configuration drift
• Help implement micro-segmentation policies and trust-model controls
• Help validate east-west traffic flows and network security control compliance against corporate standards
• Maintain patch, vulnerability, and configuration evidence to support compliance and certification audits
• Track and help remediate assigned exceptions and audit findings within defined timelines
• Take part in internal and external security audits, including evidence gathering, auditor coordination, and control walkthroughs
• 4+ years in infrastructure or security engineering, with exposure to both non-cloud and cloud environments
• Experience hardening Windows Server, Linux, and VMware vSphere
• Working experience with Active Directory, Group Policy, and Microsoft Entra ID
• Experience with Azure/AWS security controls
• Scripting fluency in Python, PowerShell, or Bash
• Experience with Infrastructure as Code, such as Terraform or Ansible
• Knowledge of GitHub and GitHub Actions for CI/CD pipelines, with a notion of HashiCorp Vault for secrets management
• Familiarity with vulnerability management platforms, cloud security certification (Azure/AWS), and ISO/SOC 2 Type 2/FedRAMP exposure are a plus
• Professional level of spoken and written English, Spanish is a plus

We are the pioneers and trailblazers of a global IT Market Category (DEX) that is shaping the future of how the world works, giving our customers’ IT Teams total digital visibility across their enterprise. Our innovative solutions integrate real-time analytics, automation, and employee feedback across all endpoints. This enables our IT teams to solve complex technical challenges, create ever more productive workplaces, and deliver happy, satisfied employees in the digital workplace.

With over 1000 employees across 5 continents, Nexthink operates as One Team, connecting, collaborating and innovating to continuously grow. We call our employees ‘Nexthinkers’ and our commitment to diversity, inclusion, and equity is second to none. We currently have over 75 nationalities working with us, from all cultures and backgrounds, speaking many different languages.

If you are looking for a change and likea nice atmosphere, lots of challenges, and having fun while working, this isa great opportunityfor you!Check what we offer:

• Permanent Contract and a competitive compensation package.
• Amazing centrallylocatedoffices near the Bernabeu Stadium.
• Private Health Insurance (Sanitas) and daily meal vouchers of 11 EUR.
• Hybrid work model balancing office and remote work.
• Flexible Hours and unlimited vacation (employees have unlimited paid time off on top of the 23 days of holidays we offer)plus 3 company-paid volunteer days.
• Up to 25 EUR per month for a gym subscription.
• Flexiblecompensation plan forchildcare & public transportation.
• Reimbursement of up to 50% of the cost of English & Spanish classes.
• Fresh fruit, cookies, and soft drinksin the office.
• Regular company and team events like Pizza talks, Team Building activities, Christmas parties, hosting Meetups at the office and more!
• Bonusesfor referring successful hires after three months of continuous employment.

The base salary for this is €33,000 – €49,000 gross per year, with a total on-target earnings (OTE) range of €36,000 – €54,000 including an annual performance bonus. You'll also be part of our broader total rewards package — including benefits tailored to where you live and how you work best.

We set our pay ranges using objective criteria: the scope and level of the role, the skills it takes to do it well, and the relevant market data. Ranges are reviewed every year to remain competitive and fair. We're transparent about this because we think you deserve to know what you're working towards from day one. In accordance with the EU Pay Transparency Directive (2023/970), we publish salary ranges on every Nexthink role. We won't ask what you currently earn or your previous salary. What matters to …