Thornburg is a global investment firm delivering on strategy for institutions, financial professionals and investors worldwide. The privately held firm, founded in 1982, is an active, high-conviction manager of fixed income, equities, and multi-asset solutions.

As an independent firm, Thornburg can take on a wide range of opportunities, explore ideas thoroughly and work across strategies to deliver consistent risk-adjusted outperformance over the long term. The firm attracts free-thinking professionals who are eager to pursue investment outcomes beyond the confines of popular wisdom. From nimble operational capabilities to principles and actions fitting of a global citizen, Thornburg’s world-class investment platform and team are aligned on strategy to serve investors.

Job Summary

The Digital Workplace Security Senior Engineer protects and continuously improves the security of Thornburg’s digital workplace by owning endpoint security standards, protection capabilities, vulnerability-management practices, security monitoring, endpoint response, and control-effectiveness reporting.

The role serves as the primary technical authority for endpoint security within Digital Workplace Services, translating risk and security requirements into practical controls and partnering with the Digital Workplace Platform Lead, Service Desk, Information Security, and Enterprise Platform Engineering to implement secure, scalable, supportable solutions. Through disciplined oversight, investigation, measurement, knowledge sharing, and continuous improvement, the Senior Engineer strengthens the firm’s endpoint security posture while balancing risk, reliability, usability, operational sustainability, and the user and client experience.

Duties and Responsibilities

Endpoint Security Standards & Control Ownership

• Establish and govern endpoint security standards, baselines, protection capabilities, and application-control requirements; periodically assess their effectiveness and recommend improvements.
• Own the administration, monitoring, tuning, and lifecycle management of approved endpoint security controls, including Microsoft Defender for Endpoint, anti-malware, host firewall, attack-surface reduction, and related capabilities.
• Define endpoint control requirements and translate risk and security objectives into practical endpoint control designs; direct implementation activities with the Digital Workplace Platform Lead and ensure ongoing effectiveness through Microsoft Intune and related platforms.
• Monitor control coverage, configuration compliance, baseline adherence, and approved exceptions; investigate material deviations and coordinate corrective action.
• Evaluate endpoint technologies and proposed changes for security risk, control effectiveness, resilience, usability, supportability, and business impact.

Vulnerability Management & Endpoint Security Questions

• Own the risk-based endpoint vulnerability-management lifecycle, including identification, prioritization, tracking, exception management, remediation coordination, validation, and reporting.
• Own remediation outcomes, direct remediation priorities with the Digital Workplace Platform Lead and Service Desk, and independently validate that corrective actions are complete and effective.
• Lead endpoint security operations, including monitoring, investigation, response coordination, escalation decisions, and resolution oversight within delegated authority, partnering with Information Security and Enterprise Platform Engineering when incidents extend beyond the endpoint environment.
• Define, govern, and report endpoint security measures and performance indicators that demonstrate control effectiveness, risk reduction, operational resilience, and continuous improvement.

Service Partnership, Governance & Continuous Improvement

• Serve as the primary escalation point for endpoint security matters, provide advanced technical guidance, approve security-control changes within delegated authority, and strengthen team capability through coaching, mentoring, and knowledge sharing.
• Maintain procedures, investigation records, knowledge articles, control documentation, and evidence that support repeatable execution, effective oversight, and audit readiness.
• Collaborate with the Digital Workplace & AI Enablement Lead on user-facing security education, responsible-use guidance, and communications.
• Support investigations, audits, assessments, control testing, access reviews, evidence collection, and other authorized risk or compliance activities.
• Coordinate security exceptions and risk acceptance through established governance processes without accepting risk outside delegated authority.
• Protect confidential information and follow applicable security, access control, data protection, change management, service management, and recordkeeping requirements.

How You'll Succeed

• Security-minded and service-oriented with a commitment to durable, practical outcomes.
• Improvement-oriented and attentive to control effectiveness, measurable risk reduction, and operational sustainability.
• Applies practical judgment when balancing security, reliability, supportability, usability, and business priorities.
• Curious and analytical, with persistence in identifying root causes and improving control effectiveness.
• Collaborative and accountable, with clear communication, dependable follow-through, sound escalation judgment, and a commitment to shared success.
• Calm, discreet, and professional in urgent, sensitive, or high-impact situations.

• Seven or more years of progressively responsible experience across endpoint security, end-user computing, enterprise technology support, or cybersecurity, including substantial responsibility for securing enterprise endpoints.
• Advanced experience with Microsoft Defender for Endpoint, Microsoft Intune security capabilities, Windows endpoint security, compliance policies, security baselines, application controls, and vulnerability remediation.
• Demonstrated experience defining security requirements, monitoring control effectiveness, investigating endpoint threats, and coordinating remediation across technical teams.
• Experience leading vulnerability management, endpoint security, or control-improvement initiatives through validation, documentation, reporting, and transition to ongoing operations.
• Ability to apply cybersecurity frameworks, benchmarks, threat information, and risk judgment to practical endpoint controls and architecture.
• Ability to influence cross-functional technical outcomes and guide colleagues without formal people-management authority.
• Strong analytical, written, verbal, documentation, organizational, and prioritization skills.

Preferred

• Advanced PowerShell experience and practical use of Microsoft Graph APIs or comparable automation capabilities.
• Experience with Microsoft Defender for Office 365, Entra ID, Netskope, Citrix, Freshservice, or comparable enterprise platforms.
• Applied experience with the NIST Cybersecurity Framework, CIS Controls, CIS Benchmarks, or comparable standards.
• Experience with control testing, audits, incident response, and evidence collection in a regulated or security-conscious environment.
• Relevant Microsoft security, endpoint security, cybersecurity, or service management certifications.

Job Benefits

• Medical, dental, and vision coverage.
• Employer 401(k) safe harbor and profit-sharing contributions.
• Work/life programs such as flexible work arrangements, flexible paid time off, paid parental leave, employee assistance program, education reimbursement program.
• Community involvement opportunities.
• Onsite cafeteria.
• Onsite fitness center.
• Referral program.

Santa Fe is the capital of New Mexico. Founded in 1610 and nicknamed "The City Different," Santa Fe captures hearts and minds with its museums, restaurants, theater, opera, and adobe-style architecture. With an average of over 300 sunny days per year and picturesque landscape, it's no wonder that outdoor activities such as skiing and hiking in "The Land of Enchantment" attract visitors from around the world.

All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, national origin, disability, gender, gender identity or protected veteran status.