Endpoint Security Engineer

About the role

Nexthink, a provider of digital employee experience management software, is looking for an Endpoint Security Engineer in Madrid to own the security of its corporate endpoint estate: about 1,200 devices (550 macOS, 650 Windows) managed through Microsoft Intune and Jamf. The role turns endpoint security into a measurable, continuously improving program covering what runs on devices, how fast they are patched and how it is proved to auditors. It is a hands-on position in a dedicated security function being built out.

Key responsibilities

• Define and maintain macOS and Windows security baselines (CIS or equivalent) via Intune and Jamf, including disk encryption, firewall, local admin removal and privilege management.
• Design and roll out application allowlisting with developer-friendly exceptions, and run remediation campaigns for unauthorized or high-risk software.
• Build and maintain the software and binary inventory, and run the application lifecycle from request to retirement.
• Own vulnerability management: scanning, risk-based prioritization, patching rings and remediation of critical and zero-day vulnerabilities.
• Enforce device compliance and trust in Conditional Access, and support data protection controls such as Microsoft Purview DLP, USB controls and passkeys/security keys.
• Document controls and automate evidence for ISO 27001, SOC 2 and ITGC audits, and turn the security posture into metrics for IT leadership, Security and Finance.
• Automate security operations with PowerShell, Python, shell scripting, Microsoft Graph and the Jamf and Intune APIs, and use the Nexthink DEX platform to measure endpoint health and build self-service remediation.

Required profile

• 5+ years in endpoint security, security engineering or end-user computing with a strong security focus.
• Hands-on experience securing macOS and Windows at scale with Microsoft Intune and Jamf (or equivalent).
• Experience with vulnerability management tooling and application control and allowlisting (MDM-native controls, Santa, AppLocker, WDAC or similar).
• Ability to work with Engineering and Product teams and communicate clearly with senior stakeholders.
• Fluent English; Spanish is a plus.

Required skills

• Knowledge of OS security and hardening frameworks (CIS, NIST, Apple platform security).
• Understanding of Microsoft Entra ID, Conditional Access and Zero Trust for devices.
• Scripting in PowerShell, Python or Bash; familiarity with REST APIs and Microsoft Graph.
• Familiarity with ISO 27001, SOC 2 or ITGC controls and audit evidence.
• Nice to have: DEX tools experience, Microsoft Purview, or certifications such as MD-102, SC-300, Jamf Certified, GIAC, CISSP or Security+.

What we offer

• Permanent contract and competitive compensation.
• Hybrid work model and flexible hours.
• Private health insurance (Sanitas) and daily meal vouchers of 11 EUR.
• Unlimited vacation plus 3 company-paid volunteer days.
• Gym subscription allowance, childcare and transport compensation plan, and reimbursement of up to 50% of English and Spanish classes.
• Bonuses for referring successful hires after three months of continuous employment.