> Markdown version of [/jobs/ext/3102716-engineer-it-security-ntd](https://www.wearedevelopers.com/jobs/ext/3102716-engineer-it-security-ntd). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Engineer, IT Security (NTD) - **Company:** Nintendo Technology Development - **Location:** Redmond, WA, United States - **Experience:** Expert - **Salary:** $145,150.0 - $261,200.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Apple Mac Systems, BitLocker Drive Encryption, Software as a Service, Cyber Security, Continuous Integration, Data Governance, Linux, Human Resources Information System (HRIS), Identity and Access Management, Information Technology Operations, Intrusion Detection and Prevention, Python (Programming Language), OAuth, OpenID, Windows PowerShell, Role-Based Access Control, Azure Active Directory, Zero Trust Network Access, Runbook, Security Information and Event Management, Policy as Code, Data Logging, Mttr, Git, Microsoft InTune, Falcon Platform, Information Technology, Casper Suite, Splunk, Software Version Control - **Published:** September 27, 2026 - **Apply:** https://www.juju.com/job/21_01a05a9e-6b6d-77ac-8a2a-0e927ea02c1d ## About the Role * 8+ years in enterprise IT/Security engineering with deep hands-on experience in: M365 administration, IAM operations, or endpoint security. * Expert-level experience with: + M365 & Entra ID: Conditional Access, MFA/SSPR, PIM/PAM, app registrations, service principals, identity lifecycle. + Endpoint Security: CrowdStrike Falcon or equivanet (policy design, RTR, detection tuning) across Win/macOS/Linux. + Logging/SIEM: Splunk or equivalent (search, dashboards, alerting, detection engineering). * Strong automation skills: PowerShell (Graph modules), Python, REST/Graph APIs; CI/CD and version control (Git). * Proven track record delivering secure baselines at scale (Intune/Jamf/MDM), and leading incident response involving identity and endpoints. * Deep understanding of Zero Trust, least privilege, RBAC, token flows (OAuth/OIDC), and modern auth (MSAL). * Experience with compliance control design and audit support. * Experience mentoring others and cultivating technical breadth and depth on a team. * Fluency in Japanese a plus. * Bachelor or Master of Science degree in Engineering, Information Technology, or related field; or equivalent combination of education and experience. ## Description Senior Engineer, IT Security for Nintendo Technology Development Inc. (NTD) organization will own and evolve the security for our Microsoft 365 (M365) tenant, drive Identity and Access Management (IAM) operations, and harden endpoint security at scale across Windows, macOS, and Linux devices. This role will be the technical driver for secure collaboration and device protection; designing, implementing, and operating controls using existing and emerging technologies. This role requires partnership with NTD IT Operations, IT security teams at Nintendo Co., Ltd. (NCL) and Nintendo of America Inc. (NOA) to deliver reliable, compliant, and auditable services with measurable outcomes., + Implement and optimize Microsoft Entra Conditional Access, tenant security defaults, privileged access policies, and MFA/SSPR at scale. + Operate and harden Microsoft Entra ID (Azure AD): lifecycle governance, automated provisioning/deprovisioning, privileged identities (PIM), app registrations, consent/permission reviews. + Build and maintain RBAC/least-privilege access models for cloud and SaaS apps; implement Just-In-Time access for admins and sensitive roles. + Integrate HRIS and identity sources for Joiner-Mover-Leaver flows, enforce identity proofing and MFA step-up for high-risk transactions. + Design and enforce data governance (labels, DLP, retention, eDiscovery/Legal Hold, insider risk signals) and collaboration controls (external sharing, guest access, B2B/B2C). + Establish monitoring/alerting/SLAs for tenant and identity related services; lead incident response and help develop IR playbooks in conjunction with IT Security Operations. * Endpoint Security (Windows, macOS, Linux) + Own the migration from an existing endpoint management system to a more robust solution, such as the CrowdStrike Falcon platform, for all endpoints: sensor deployment/coverage, policy tuning, RTR workflows, and threat hunting guardrails. + Lead efforts with platform engineers for OS-specific hardening baselines (CIS/NIST) and secure configuration: BitLocker/FileVault/LUKS, kernel extension/driver policies, local admin control, application allow/deny lists. + Lead incident triage and response on endpoints, including containment, forensic collection, and post-incident hardening. * Observability, Detection & Response + Build and operationalize Splunk detections and dashboards integrating M365, Entra, CrowdStrike, Defender, Intune, and OS logs. + Develop automated response playbooks to reduce MTTR. * Automation & Engineering Excellence + Create robust automation and self-service tooling for identity and endpoint operations. + Maintain IaC for policy-as-code (e.g. Conditional Access, PIM role settings). + Document runbooks, architecture diagrams, inventories, and SOPs; mentor engineers and drive operational maturity. * Compliance & Risk + Map controls to regulatory frameworks (SOX, J-SOX etc.); support audits with evidence and narratives. + Lead periodic access reviews, admin entitlement recertification, and break-glass account governance. + Conduct tabletop exercises, disaster recovery testing, and security drills tied to identity and endpoint scenarios. * Up to 10% travel; domestic and international. ## Related Videos - [The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most](https://www.wearedevelopers.com/videos/100254-the-developer-workstation-blind-spot-why-your-security-stack-can-t-see-what-matters-most) - [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94) - [Reducing Cognitive Overload Through Platform Engineering](https://www.wearedevelopers.com/videos/679-reducing-cognitive-overload-through-platform-engineering) - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Git for Code Reviews](https://www.wearedevelopers.com/videos/429-git-for-code-reviews) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 115 password beefstew is not Strog/|n0FF](https://www.wearedevelopers.com/magazine/429-dev-digest-115-password-beefstew-is-not-strog-n0ff) - [Dev Digest 129 - Now that's what I call private data!](https://www.wearedevelopers.com/magazine/468-dev-digest-129-now-that-s-what-i-call-private-data)