IT Infrastructure Security Engineer

About the role

Nexthink, a provider of digital employee experience management software, is looking for an Infrastructure Security Engineer in Madrid. The engineer designs, automates, documents and defends the technical security controls protecting the company's corporate infrastructure across non-cloud, cloud and internal network environments, reporting to the Infrastructure Security Lead. The role suits a hands-on engineer comfortable in a fast-moving environment.

Key responsibilities

• Contribute to hardening baselines across the VM fleet (Windows, Linux)
• Support security controls for Active Directory, Group Policy and Microsoft Entra ID
• Take part in patch automation and help reach emergency patching coverage for critical CVEs
• Contribute to cloud security posture management across Azure and AWS, including policy-as-code and remediation of configuration drift
• Help implement micro-segmentation policies and trust-model controls, and validate east-west traffic flows
• Maintain patch, vulnerability and configuration evidence for compliance and certification audits, and track and remediate exceptions and audit findings
• Take part in internal and external security audits, and own the technical documentation and evidence for infrastructure security controls
• Defend implementation choices with GRC and security teams

Required profile

• 4+ years in infrastructure or security engineering, with exposure to both non-cloud and cloud environments
• Experience hardening Windows Server, Linux, VMware vSphere and hybrid infrastructure
• Working experience with Active Directory, Group Policy and Microsoft Entra ID
• Fluent spoken and written English; Spanish is a plus

Required skills

• Scripting in Python, PowerShell or Bash to automate security and infrastructure tasks
• Infrastructure as Code, such as Terraform or Ansible
• GitHub and GitHub Actions for CI/CD, with a notion of HashiCorp Vault for secrets management
• Plus: vulnerability management platforms, Azure/AWS cloud security certifications, ISO/SOC 2 Type 2 or FedRAMP exposure

What we offer

• Permanent contract, base salary of 33,000 - 49,000 EUR gross per year, OTE of 36,000 - 54,000 EUR including a performance bonus
• Hybrid work model, flexible hours and unlimited paid leave plus 3 company-paid volunteer days
• Private health insurance, daily meal vouchers, gym subscription allowance and childcare and transport compensation plan
• Reimbursement of up to 50% of English and Spanish classes, and regular company events