Endpoint Security Engineer — Hybrid, Flexible Hours, Unlimited PTO

Nexthink; Madrid; Hybrid; EUR 70,000 - 90,000; Full time

Benefits offered by this job

Permanent contract

Hybrid work model

Private health insurance

Meal vouchers

Job summary

Nexthink seeks an Endpoint Security Engineer to own the security of its corporate endpoint estate (macOS and Windows) managed through Intune and Jamf. You will shape an measurable security program, baselines, patching, and compliance evidence while maintaining strong user experience.

You will implement application allowlisting, vulnerability remediation, and data protection controls, reporting to Security leadership and partnering with IT and Engineering teams in a hybrid Madrid-based role.

Qualifications

• 5+ years in endpoint security or end-user computing with a strong security focus.
• Hands-on experience with macOS and Windows at scale using Intune and Jamf.
• Experience with vulnerability management tooling and remediation workflows.
• Knowledge of OS security frameworks (CIS, NIST).
• Familiarity with ISO 27001/SOC2 audits and data protection.

Responsibilities

• Define and maintain security baselines for macOS and Windows via Intune and Jamf.
• Own vulnerability management: scanning, prioritization, remediation tracking.
• Design and rollout application allowlisting and governance across platforms.
• Partner with teams to enforce Zero Trust and data protection controls.

Skills

Endpoint security

macOS security

Windows security

Intune

Jamf

Vulnerability management

Scripting

PowerShell

Python

Microsoft Graph

Education

Bachelor's degree in Computer Science or related

Tools

PowerShell

Python

Jamf Pro

Intune

Microsoft Graph

Job description

Nexthink seeks an Endpoint Security Engineer to own the security of its corporate endpoint estate (macOS and Windows) managed through Intune and Jamf. You will shape an measurable security program, baselines, patching, and compliance evidence while maintaining strong user experience.

You will implement application allowlisting, vulnerability remediation, and data protection controls, reporting to Security leadership and partnering with IT and Engineering teams in a hybrid Madrid-based role.