Endpoint Security Engineer

About the role

Vitol, an energy group with offices worldwide, is looking for an Endpoint Security Engineer to join its Technology department in Geneva. The role protects Vitol's endpoints (desktops, laptops, VDIs, mobiles and tablets) and the Microsoft 365 workplace around them, across its global operations, and plays a central part in the adoption of cloud-native device management such as Microsoft Intune and Workspace One.

Key responsibilities

• Deploy, configure and maintain the security stack, including sensor rollout, prevention and detection policies, exclusions, device control and settings.
• Maintain hardening baselines, disk encryption, patching and vulnerability remediation across Windows, macOS and mobile devices, applying attack surface reduction rules.
• Engineer Intune for security (compliance policies, configuration profiles, security baselines, app protection, modern device provisioning) and contribute to the Intune rollout with configuration-as-code and conditional access.
• Implement Entra ID controls tied to device and identity health, including Conditional Access, device compliance and multi-factor authentication.
• Apply Microsoft 365 security and compliance controls for endpoints, such as data loss prevention and information protection.
• Integrate EDR and EPP systems with Intune and Entra ID so device risk informs access decisions.
• Monitor endpoint security posture and incidents with security operations, drive remediation to closure and assess exposure to new threats.
• Automate deployment, compliance checks and reporting with PowerShell and the Microsoft Graph API.
• Maintain security standards, operating procedures and documentation, and support audits aligned with ISO 27001, NIST and CIS.
• Work with Cyber Security & Assurance on DLP rules and sensitivity labels across devices.

Required profile

• Undergraduate or postgraduate degree in a technical discipline, or equivalent experience.
• 5+ years of experience engineering endpoint security in an enterprise environment.
• Fluent English and French.
• Analytical, collaborative and pragmatic, able to explain security decisions to technical teams and end users and balance security with a smooth user experience.

Required skills

• Hands-on EDR/EPP experience (CrowdStrike, Palo Alto, M365 Security).
• Strong hands-on experience with Microsoft Intune across Windows, macOS, iOS and Android.
• Solid knowledge of Entra ID, including Conditional Access and multi-factor authentication.
• Very good knowledge of Microsoft 365 security and compliance, including DLP and PureView retention policies.
• Hardening, encryption, patching and vulnerability management.
• PowerShell and the Microsoft Graph API; SCCM / Configuration Manager experience is an advantage.
• Certifications such as MD-102, SC-200, SC-300, CCFA, CCFR, CISSP or ISSEP are an advantage.