Endpoint Security Engineer

Vitol is seeking an Endpoint Security Engineer to join its Technology department. The role is

accountable for protecting Vitol's Endpoints (Desktops, Laptops, VDIs, Mobiles & Tablets) and

the Microsoft 365 workplace around them, across our worldwide operations.

The Endpoint Security Engineer will engineer and run endpoint protection with products such as

CrowdStrike, Palo Alto, Tanium, and device management and compliance with

Intune/AirWatch/Workspace One, and Microsoft 365 Security.

The role also plays a central part in Vitol's transformation and adoption of cloud-native device

management such as Microsoft Intune & Workspace One

The Endpoint Security Engineer will work closely with the CISO organization, the local IT Support

& infrastructure teams, and the Cloud & Network teams.

Key areas of responsibility for the Endpoint Security Engineer include:

Endpoint Protection

Deploy, configure, and maintain Vitol’s security stack across the

estate, covering sensor rollout and health, prevention and detection policies, exclusions,

device control, and related settings.

Hardening & Patching

Maintain hardening baselines, disk encryption, patching, and

vulnerability remediation across Windows, macOS, and mobile devices. Ensure Attack

surface reduction rules are applied across all devices.

Device Management

Engineer Intune for security, including compliance policies,

configuration profiles, security baselines, app protection, and modern device provisioning.

Intune Migration

Contribute to the rollout of Intune, making sure security controls carry over

and improved, insuring configuration-as-code for Intune & conditional access

Identity & Access

Ensure Entra ID controls defined by the IAM team are well implemented

and that tie access to device and identity health, including Conditional Access, device

compliance, and multi-factor authentication.

Microsoft 365 Security

Apply Microsoft 365 security and compliance controls relevant to

endpoints, such as data loss prevention and information protection.

Integration

Integrate EDR and EPP systems with Intune and Entra ID so that device risk

informs access decisions.

Monitoring & Reporting

Monitor endpoint security posture, and incidents with security

operations, drive remediation to closure, and assess exposure to new threats.

Automation

Automate deployment, compliance checks, and reporting with PowerShell and

the Microsoft Graph API.

Standards & Compliance

Maintain endpoint security standards, operating procedures, and

documentation, and support audits aligned with ISO 27001, NIST, and CIS.

DLP

Working in close collaboration with Cyber Security & Assurance to ensure proper

deployment of DLP rules and sensitivity labels across devices.

Education

Undergraduate or postgraduate degree in a technical discipline (Computer

Science, Engineering, Information Security, or a related field), or equivalent experience.

Endpoint Security Experience

5+ years of experience engineering endpoint security in an

enterprise environment.

EDR/EPP

Strong hands-on experience, covering deployment, policy design, tuning, and

investigation with main EDR tools in the market such as CrowdStrike, Palo Alto, M365

Security

Microsoft Intune

Strong hands-on experience across Windows, macOS, iOS, and Android.

Entra ID

Solid knowledge of Entra ID, including Conditional Access, device identity, and

multi-factor authentication.

Microsoft 365/DLP

Very good knowledge of Microsoft 365 security and compliance

capabilities, Microsoft Pureview for retention policies and DLP.

Hardening & Vulnerability Management

Strong grasp of endpoint hardening, encryption,

patching, and vulnerability management.

Scripting & Automation

Experience with PowerShell and the Microsoft Graph API.

Frameworks

Working knowledge of the CIS, NIST, and ISO 27001 frameworks.

SCCM & Intune

Experience with SCCM / Configuration Manager, and with migrating from it

to Intune, is an advantage.

Certifications

Microsoft MD-102, SC-200, or SC-300, or CrowdStrike Certified Falcon

Administrator (CCFA) or Responder (CCFR), CISSP/ISSEP is an advantage

Industry

Familiarity with commodity trading or financial services technology environments is

an advantage.

Languages

Fluent English/French

• Analytical & Improvement-Minded

Brings an analytical mindset and a focus on continuous

improvement.

Clear Communicator

Explains security decisions to both technical teams and end users,

and documents them well.

• Stakeholder Management

Balances security with a smooth working experience for traders

and employees.

Highly Collaborative

Works well with helpdesk, infrastructure, and security colleagues, and

shares knowledge freely.

Pragmatic & Outcome-Oriented

Prioritizes by risk and sees remediation through to

closure.

Decisive & Action-Oriented

Comfortable setting priorities and delivering at pace in a flat,

high-ownership culture.