Endpoint Security Engineer

Vitol is seeking an Endpoint Security Engineer to join its Technology department. The role is 
accountable for protecting Vitols Endpoints (Desktops Laptops VDIs Mobiles & Tablets) and 
the Microsoft 365 workplace around them across our worldwide operations. 
The Endpoint Security Engineer will engineer and run endpoint protection with products such as 
CrowdStrike Palo Alto Tanium and device management and compliance with 
Intune/AirWatch/Workspace One and Microsoft 365 Security. 
The role also plays a central part in Vitols transformation and adoption of cloud-native device 
management such as Microsoft Intune & Workspace One 
The Endpoint Security Engineer will work closely with the CISO organization the local IT Support 
& infrastructure teams and the Cloud & Network teams. 

Key areas of responsibility for the Endpoint Security Engineer include: 
Endpoint Protection: Deploy configure and maintain Vitols security stack across the 
estate covering sensor rollout and health prevention and detection policies exclusions 
device control and related settings. 
Hardening & Patching: Maintain hardening baselines disk encryption patching and 
vulnerability remediation across Windows macOS and mobile devices. Ensure Attack 
surface reduction rules are applied across all devices. 
Device Management: Engineer Intune for security including compliance policies 
configuration profiles security baselines app protection and modern device provisioning. 
Intune Migration: Contribute to the rollout of Intune making sure security controls carry over 
and improved insuring configuration-as-code for Intune & conditional access 
Identity & Access: Ensure Entra ID controls defined by the IAM team are well implemented 
and that tie access to device and identity health including Conditional Access device 
compliance and multi-factor authentication. 
Microsoft 365 Security: Apply Microsoft 365 security and compliance controls relevant to 
endpoints such as data loss prevention and information protection. 
Integration: Integrate EDR and EPP systems with Intune and Entra ID so that device risk 
informs access decisions. 
Monitoring & Reporting: Monitor endpoint security posture and incidents with security 
operations drive remediation to closure and assess exposure to new threats. 
Automation: Automate deployment compliance checks and reporting with PowerShell and 
the Microsoft Graph API. 
Standards & Compliance: Maintain endpoint security standards operating procedures and 
documentation and support audits aligned with ISO 27001 NIST and CIS. 
DLP: Working in close collaboration with Cyber Security & Assurance to ensure proper 
deployment of DLP rules and sensitivity labels across devices. 

Qualifications :

Education: Undergraduate or postgraduate degree in a technical discipline (Computer 
Science Engineering Information Security or a related field) or equivalent experience. 
Endpoint Security Experience: 5 years of experience engineering endpoint security in an 
enterprise environment. 
EDR/EPP: Strong hands-on experience covering deployment policy design tuning and 
investigation with main EDR tools in the market such as CrowdStrike Palo Alto M365 
Security 
Microsoft Intune: Strong hands-on experience across Windows macOS iOS and Android. 
Entra ID: Solid knowledge of Entra ID including Conditional Access device identity and 
multi-factor authentication. 
Microsoft 365/DLP: Very good knowledge of Microsoft 365 security and compliance 
capabilities Microsoft Pureview for retention policies and DLP. 
Hardening & Vulnerability Management: Strong grasp of endpoint hardening encryption 
patching and vulnerability management. 
Scripting & Automation: Experience with PowerShell and the Microsoft Graph API. 
Frameworks: Working knowledge of the CIS NIST and ISO 27001 frameworks. 
SCCM & Intune: Experience with SCCM / Configuration Manager and with migrating from it 
to Intune is an advantage. 
Certifications: Microsoft MD-102 SC-200 or SC-300 or CrowdStrike Certified Falcon 
Administrator (CCFA) or Responder (CCFR) CISSP/ISSEP is an advantage 
Industry: Familiarity with commodity trading or financial services technology environments is 
an advantage. 
Languages: Fluent English/French 

Additional Information :

Analytical & Improvement-Minded: Brings an analytical mindset and a focus on continuous 
improvement. 
Clear Communicator: Explains security decisions to both technical teams and end users 
and documents them well. 

Stakeholder Management: Balances security with a smooth working experience for traders 
and employees. 
Highly Collaborative: Works well with helpdesk infrastructure and security colleagues and 
shares knowledge freely. 
Pragmatic & Outcome-Oriented: Prioritizes by risk and sees remediation through to 
closure. 
Decisive & Action-Oriented: Comfortable setting priorities and delivering at pace in a flat 
high-ownership culture. 

Remote Work :

No

Employment Type :

Full-time