Engineer Endpoint Security

Grant Thornton Capability Center Poland (GTCC) supports operations of the Grant Thornton Advisors multinational platform. The center brings together people, technology, and delivery capabilities to help teams work across markets and time zones, providing scale, coordination, and operational support for a multinational platform comprising over 25,000 professionals across 20+ firms.

• Three or more years in information technology, including at least one year working directly with endpoint security or systems management tooling.
• Practical administration experience with endpoint detection and response or anti-malware consoles and enterprise software deployment tools such as Intune or SCCM.
• Sound knowledge of Windows administration, with working familiarity with macOS or Linux endpoints.
• Scripting ability in PowerShell, Bash, or Python sufficient to automate routine tasks and parse platform output.
• Fluency in English and Polish.

Nice to have:

• Security certifications such as CompTIA Security+, Microsoft SC-200, or a vendor endpoint certification.
• Exposure to security operations center workflows, ticketing platforms, and change management in a regulated environment.

• Deploy, upgrade, and troubleshoot endpoint security agents across workstations and servers, driving agent coverage and health metrics to target.
• Implement approved policy, exclusion, and device control changes through the standard change process, including testing evidence and rollback plans.
• Triage endpoint alerts and platform tickets, resolving routine issues directly and escalating complex detections with clear technical summaries.
• Reconcile endpoint coverage against the asset inventory, investigate unprotected and stale hosts, and report gaps to the platform owner.
• Maintain runbooks, architecture diagrams, and control documentation to meet internal audit and external assessment standards.
• Participate in an on-call rotation and scheduled change windows, including occasional work outside standard business hours.
• Automate repetitive configuration and operational tasks, treating platform configuration as code wherever tooling supports it.
• Support incident response and forensic investigations with platform expertise, evidence, and rapid containment actions.
• Maintain knowledge base articles and contribute scripts to reduce manual handling of recurring endpoint issues.