Corporate Security Engineer (Endpoint and ISG)

Corporate Security Engineer (Endpoint and ISG)

Reports to: Head of Security · Location: Nicosia, Cyprus · Works with: Corporate IT

The role

You secure every TRG laptop, account and browser. You turn the ISG Policy into enforced, measured controls across a mixed fleet of laptops and mobile devices. Corporate IT runs enrolment and user support; you define the controls, prove compliance, and respond to alerts.

Outcomes you will own

• Keep every company device enrolled in device management and named to internal conventions.
• Maintain CIS benchmark compliance across the fleet; report it from device management dashboards.
• Patch critical OS and application vulnerabilities within a 7-day SLA across the fleet.
• Run endpoint detection and response on every laptop.
• Prevent data leakage across endpoints, email, browsers and cloud apps; detect and block exfiltration attempts.
• Enforce device posture so only company-managed devices reach internal systems.
• Run threat protection across endpoints and collaboration tools: malware, phishing, account takeover and insider risk.
• Control third-party app sign-in with company identity through an allowlist.
• Manage browsers centrally on every OS.
• Separate work and personal data on mobile devices.
• Maintain endpoint and identity standards under the ISG Policy, including naming and enrolment conventions; run security awareness training and phishing simulations.
• Run the infostealer feed; for leaked TRG credentials, reset passwords, revoke sessions and check the device within 4 hours.
• Write data leakage and threat response playbooks with pre-approved containment: disable account, isolate laptop, wipe device.
• Own employee identity: SSO, MFA, joiner-mover-leaver access and quarterly access reviews.

First 90 days

• Review fleet enrolment, compliance and patch status; report findings to the Head of Security.
• Extend hardened configurations to developer laptops without breaking printing, video calls or local Docker work.
• Ship the first five data leakage and threat detections, starting with offboarding-window exfiltration.

What you bring

• 4+ years in endpoint or corporate security across multiple desktop and mobile operating systems.
• Hands-on with enterprise device management (MDM and UEM) platforms.
• Hands-on with data loss prevention, context-aware access and OAuth app control in SaaS collaboration suites.
• Experience with zero trust access (Cloudflare Zero Trust or similar).
• Scripts in Bash, Python or Apps Script to automate checks and fixes.
• Rolls out restrictive controls to developers without stopping their work.

Nice to have

• Experience mapping controls to SOC 2 or ISO 27001.
• CIS benchmark authoring or compliance-as-code tooling.
• Familiarity with GDPR rules on employee monitoring.