Endpoint Security Engineer

About the role

This role plays a key part in designing and implementing BTs Zero Trust Security Model, helping to strengthen the organisation’s global security posture. Working across Microsoft Entra ID, Microsoft Purview, Microsoft Intune, and Microsoft Defender, the role supports enterprise-wide identity, security, compliance, and governance initiatives. Responsibilities include enabling secure access, information protection, data governance, endpoint security, and automation across BT’s technology landscape.

As part of the Endpoint Security team, you will work on initiatives focused on improving BT’s endpoint security posture, enhancing device compliance, reducing risk, and driving the adoption of security best practices across the enterprise.

What you will be doing (Role Accountabilities)

• Device Compliance Reporting: Onboard mobile, web, desktop and single-page applications into Microsoft Entra ID for single sign-on and provisioning.
• Endpoint Security Controls: Enhance BT’s security posture through controls such as multifactor authentication, passwordless authentication and device-based access restrictions.
• B2B access governance: Configure access packages, policies and access reviews for business-to-business access.
• Microsoft 365 security and compliance: Contribute to the enterprise rollout of Microsoft 365 security and compliance capabilities.
• Information protection: Design and implement sensitivity labels and label policies across Exchange, SharePoint, Teams and OneDrive.
• Data loss prevention: Create and maintain DLP and Endpoint DLP policies across Microsoft 365 and non-Microsoft workloads.
• Records and retention: Build and manage retention labels and retention policies aligned with BT data standards.
• Automation: Automate processes using Power Automate, Power Apps and Logic Apps.
• Troubleshooting and analysis: Resolve identity, access and security issues and provide root-cause analysis.
• Threat readiness: Monitor emerging threats and evaluate BT’s readiness against modern attack vectors.
• Cross-functional collaboration: Build strong relationships across BT to identify opportunities and deliver impactful business outcomes.
• Decision-making and communication: Work effectively through ambiguity, simplify complexity, make informed recommendations and translate technical concepts for diverse audiences.

What you’ll need to succeed (Skills & Experience)

• Deep expertise in Microsoft, including Conditional Access, Identity Protection, Intune, and Endpoint Security Technologies
• Optional: Hands-on experience with Microsoft Purview capabilities, including Information Protection, DLP, Insider Risk and Data Security Posture Management for AI.
• Experience integrating authentication frameworks using Microsoft Authentication Library or Apache OpenID Connect libraries.
• Strong knowledge of SAML, OAuth 2.0, OpenID Connect and SCIM.
• Experience with KQL, monitoring tools, SIEM, workbooks and incident management.
• Proficiency with Power Automate, Power Apps and Power BI.
• Exposure to the Microsoft Defender stack, including Defender for Cloud Apps, Endpoint, Identity and Office 365.
• Ability to write PowerShell scripts and build REST APIs using Logic Apps.
• Strong analytical, debugging and problem-solving skills, with curiosity to learn and adapt to evolving security technologies.
• Ability to work independently and collaboratively in fast-paced environments, with familiarity with scripting and coding concepts.