Corporate Security Engineer - Endpoint and ISG

Corporate Security Engineer (Endpoint and ISG)

Reports to: Head of Security · Location: Nicosia, Cyprus · Works with: Corporate IT

The role

You secure every TRG laptop, account and browser. You turn the ISG Policy into enforced, measured controls across a mixed fleet of laptops and mobile devices. Corporate IT runs enrolment and user support; you define the controls, prove compliance, and respond to alerts.

Outcomes you will own

• Keep every company device enrolled in device management and named to internal conventions.
• Maintain CIS benchmark compliance across the fleet; report it from device management dashboards.
• Patch critical OS and application vulnerabilities within a 7-day SLA across the fleet.
• Run endpoint detection and response on every laptop.
• Prevent data leakage across endpoints, email, browsers and cloud apps; detect and block exfiltration attempts.
• Enforce device posture so only company-managed devices reach internal systems.
• Run threat protection across endpoints and collaboration tools: malware, phishing, account takeover and insider risk.
• Control third-party app sign-in with company identity through an allowlist.
• Manage browsers centrally on every OS.
• Separate work and personal data on mobile devices.
• Maintain endpoint and identity standards under the ISG Policy, including naming and enrolment conventions; run security awareness training and phishing simulations.
• Run the infostealer feed; for leaked TRG credentials, reset passwords, revoke sessions and check the device within 4 hours.
• Write data leakage and threat response playbooks with pre-approved containment: disable account, isolate laptop, wipe device.
• Own employee identity: SSO, MFA, joiner-mover-leaver access and quarterly access reviews.

First 90 days

1. Review fleet enrolment, compliance and patch status; report findings to the Head of Security.
2. Extend hardened configurations to developer laptops without breaking printing, video calls or local Docker work.
3. Ship the first five data leakage and threat detections, starting with offboarding-window exfiltration.

What you bring

• 4+ years in endpoint or corporate security across multiple desktop and mobile operating systems.
• Hands-on with enterprise device management (MDM and UEM) platforms.
• Hands-on with data loss prevention, context-aware access and OAuth app control in SaaS collaboration suites.
• Experience with zero trust access (Cloudflare Zero Trust or similar).
• Scripts in Bash, Python or Apps Script to automate checks and fixes.
• Rolls out restrictive controls to developers without stopping their work.

Nice to have

• Experience mapping controls to SOC 2 or ISO 27001.
• CIS benchmark authoring or compliance-as-code tooling.
• Familiarity with GDPR rules on employee monitoring.