• As a Senior Corporate Security Engineer at Nexthink, you will be responsible for the security of our internal environment. • You will be architecting the security fabric that enables our rapid growth. • Working in close partnership with IT, business teams and partnering with our Cloud and Application Security teams, you will secure the identity, devices, and applications used by "Nexthinkers" worldwide. • You will own the security of a complex SaaS ecosystem, and lead detection and response for the corporate environment. • Contribute to the design and support the implementation of passwordless authentication and Zero Trust principles. • Manage secure provisioning and lifecycle management, ensuring least-privilege access across all business systems. • Define and enforce security baselines for our diverse fleet of endpoints (Windows, macOS) and mobile devices via MDM (Intune/Jamf). • Proactively identify and mitigate security risks in our corporate environment, conducting regular security assessments and vulnerability scans. • Lead incident response activities for corporate security events (phishing, malware, lost devices).

• Identity-Centric Security Architecture: Contribute to the design and support the implementation of passwordless authentication and Zero Trust principles. • Manage secure provisioning and lifecycle management, ensuring least-privilege access across all business systems. • Partner with HR and IT to streamline onboarding/offboarding workflows, ensuring timely access revocation and auditability. • Define and enforce security baselines for our diverse fleet of endpoints (Windows, macOS) and mobile devices via MDM (Intune/Jamf). • Manage and tune EDR/XDR solutions to ensure high-fidelity detection on workstations and servers (Windows, Linux, macOS). • Proactively identify and mitigate security risks in our corporate environment, conducting regular security assessments & vulnerability scans. • Lead incident response activities for corporate security events (phishing, malware, lost devices). • Develop automation scripts (Python/PowerShell) and workflows (SOAR) to automate manual security tasks, evidence collection, and response actions.

• Identity-Centric Security Architecture: Contribute to the design and support the implementation of passwordless authentication and Zero Trust principles. • Manage secure provisioning and lifecycle management, ensuring least-privilege access across all business systems. • Partner with HR and IT to streamline onboarding/offboarding workflows, ensuring timely access revocation and auditability. • Define and enforce security baselines for our diverse fleet of endpoints (Windows, macOS) and mobile devices via MDM (Intune/Jamf). • Manage and tune EDR/XDR solutions to ensure high-fidelity detection on workstations and servers (Windows, Linux, macOS). • Secure the corporate Azure footprint, ensuring proper configuration of subscriptions, networking, and resources distinct from our production product environment. • Proactively identify and mitigate security risks in our corporate environment, conducting regular security assessments and vulnerability scans. • Coordinate vulnerability management and patch management. • Collaborate with IT to automate endpoint compliance checks and remediation workflows. • Support the development and maintenance of Infrastructure-as-Code. • Ensure hardening and compliance of endpoints and servers. • SaaS Security & Integration: Assess and secure third-party SaaS integrations (e.g., Salesforce apps, browser extensions, productivity tools) to prevent data leakage and over-privileged access. • Collaborate with Legal and Compliance to vet new vendors and tools. • Configure and maintain CASB and DLP policies to safeguard sensitive corporate data without hindering productivity. • Lead incident response activities for corporate security events (phishing, malware, lost devices). • Develop automation scripts (Python/PowerShell) and workflows (SOAR) to automate manual security tasks, evidence collection, and response actions. • Proactively hunt for threats within the corporate network and identity providers. • Develop incident response playbooks including technology specific procedures and forensics collection. • Design and implement security controls to safeguard corporate resources, including endpoints, data storage, networking, computing and identity and access management. • Support and automate evidence collection for audits. • Act as the primary security liaison to the IT Department and business teams, helping them build security into their operations (DevSecOps for IT). • Design and deliver technical security training and awareness campaigns for engineering and business teams.

• Lead the implementation, assessment, and continuous improvement of security controls aligned with NIST SP 800-171 and CMMC 2.0, ensuring organizational readiness for Level 2 certification. • Own and maintain the System Security Plan (SSP), Plans of Action and Milestones (POA&M), security policies, procedures, and compliance documentation. • Map and protect Controlled Unclassified Information (CUI) throughout its lifecycle, including data flows across engineering design (CAD/CAM), procurement, quality, manufacturing, and external suppliers. • Serve as the primary liaison for CMMC assessments, including coordination with C3PAOs, audit preparation, artifact management, and remediation tracking. • Implement and monitor security controls across both IT and OT environments, including identity and access management, multi-factor authentication, encryption, endpoint detection and response (EDR), SIEM, firewalls, and network segmentation. • Conduct vulnerability scanning, risk assessments, and gap analyses against NIST SP 800-171 controls, prioritizing mitigation efforts based on operational and contractual risk. • Lead cyber incident response activities, including documentation and reporting of incidents impacting CUI within required DFARS timelines (e.g., 72-hour reporting). • Partner cross-functionally with engineering, operations, quality, and leadership to embed cybersecurity into product development and manufacturing processes. • Oversee relationships with managed service providers (MSPs), cloud providers, and external security vendors to ensure secure configurations and regulatory compliance. • Develop and deliver practical cybersecurity training tailored to aerospace manufacturing personnel, including phishing awareness, secure technical data handling, and CUI best practices. • Establish compliance dashboards and executive reporting mechanisms to provide visibility into security posture and remediation progress. • Support and secure cloud environments, including Microsoft GCC High or Azure Government, where applicable.