Corporate security engineer

You secure every TRG laptop, account and browser. You turn the ISG Policy into enforced, measured controls across a mixed fleet of laptops and mobile devices. Corporate IT runs enrolment and user support; you define the controls, prove compliance, and respond to alerts.

• Keep every company device enrolled in device management and named to internal conventions
• Maintain CIS benchmark compliance across the fleet; report it from device management dashboards
• Patch critical OS and application vulnerabilities within a 7-day SLA across the fleet
• Run endpoint detection and response on every laptop
• Prevent data leakage across endpoints, email, browsers and cloud apps; detect and block exfiltration attempts
• Enforce device posture so only company-managed devices reach internal systems
• Run threat protection across endpoints and collaboration tools: malware, phishing, account takeover and insider risk
• Control third-party app sign-in with company identity through an allowlist
• Manage browsers centrally on every OS
• Separate work and personal data on mobile devices
• Maintain endpoint and identity standards under the ISG Policy, including naming and enrolment conventions; run security awareness training and phishing simulations
• Run the infostealer feed; for leaked TRG credentials, reset passwords, revoke sessions and check the device within 4 hours
• Write data leakage and threat response playbooks with pre-approved containment: disable account, isolate laptop, wipe device
• Own employee identity: SSO, MFA, joiner-mover-leaver access and quarterly access reviews
• Review fleet enrolment, compliance and patch status; report findings to the Head of Security
• Extend hardened configurations to developer laptops without breaking printing, video calls or local Docker work
• Ship the first five data leakage and threat detections, starting with offboarding-window exfiltration

• 4+ years in endpoint or corporate security across multiple desktop and mobile operating systems
• Hands-on with enterprise device management (MDM and UEM) platforms
• Hands-on with data loss prevention, context-aware access and OAuth app control in SaaS collaboration suites
• Experience with zero trust access (Cloudflare Zero Trust or similar)
• Scripts in Bash, Python or Apps Script to automate checks and fixes
• Rolls out restrictive controls to developers without stopping their work
• Будет плюсом: Experience mapping controls to SOC 2 or ISO 27001; CIS benchmark authoring or compliance-as-code tooling; Familiarity with GDPR rules on employee monitoring

• Условий в вакансии нет