Security Engineer - EMEA

We're looking for a Security & Trust Specialist to join Pencil at a pivotal moment of growth. This is a hands-on, technical role for someone with a background in desktop support, IT systems administration or a similar technical operations role who is now building a career in security. You'll own the day-to-day security operations that keep Pencil safe — endpoints, identity and access, cloud and SaaS security — and you're happy to lend a hand with practical IT and device issues where needed. You'll work directly with our Head of Security & Trust, who will support your growth into the audit, compliance and vendor-risk side of the role over time.

Key responsibilities:

• Administer and secure endpoints (MDM/Intune, patching, encryption, device compliance), and be willing to pitch in on practical desktop support and device issues when the team needs a hand.

• Own day-to-day identity and access management — joiner/mover/leaver processes, least-privilege access and quarterly access reviews across Google Workspace, Microsoft 365, GCP and other SaaS tools.

• Monitor security alerts and logs, escalate promptly, and help investigate and document security events (suspicious logins, compromised credentials, device loss, cloud misconfiguration).

• Support compliance evidence collection in Vanta for SOC 2, ISO 27001 and ISO 42001, working alongside the Head of Security & Trust rather than owning audit strategy yourself.

• Help gather evidence for vendor and customer security questionnaires, and flag anything that needs escalating.

• Identify and implement practical improvements to monitoring, alerting and access control across cloud and endpoint tooling.

Your background:

• A background in desktop support, IT systems administration or a similar technical operations role, now moving into (or already doing blended IT/security) work.

• Hands-on experience with endpoint management (Intune or similar MDM) and Google Workspace or Microsoft 365 administration.

• Comfortable with cloud basics (GCP, AWS or Azure IAM) — you don't need deep cloud engineering experience, but you're curious and capable of learning fast.

• Some exposure to compliance or audit evidence gathering (Vanta or similar) is a bonus, not required.

• A security certification such as CompTIA Security+, ISC2 Certified in Cybersecurity or Microsoft SC-900 — or clear evidence of self-directed learning if you don't have one yet.

• A genuinely helpful, practical approach — you don't mind switching between security work and helping a colleague with their laptop.

You’ll Thrive Here If You…

• You enjoy being hands-on and don't mind switching between strategic security work and practical, in-the-moment IT problems (Human).

• You're hungry to grow a career in security and want to learn from the audits and questionnaires you'll be exposed to (Owners).

• You take ownership of problems end-to-end and don't wait to be told what to do (Owners).

• You can explain technical issues simply to non-technical colleagues (Simple).

KPIs & Success Measures

• Access reviews and joiner/mover/leaver tasks completed within SLA, with zero access-control audit findings.

• Endpoint compliance rate (encryption, patching, MDM enrolment) across the device fleet.

• Time-to-close on security incidents and IT/device issues you support.

• Quality and completeness of evidence you contribute to Vanta and vendor reviews.

Benefits:

• 25 days PTO plus public holidays, although we operate a Flexible Time Off scheme

• Health insurance / private medical cover

• Monthly stipend towards wellness, fitness, and learning and development

• Remote - work from anywhere in your home country

• Enhanced parental leave policies, whether you become a parent through birth, adoption or surrogacy

• Access to our Pencil office in The Shard, London for UK employees

• Flexible working hours