Endpoint Security Engineer

Endpoint Security Engineer (Senior)

Own and strengthen endpoint security across Windows, macOS, Linux, and mobile platforms. Drive protection, detection, response, and compliance by designing controls, operating EDR/XDR tooling, and partnering with IT operations for patching and hardening. Contribute to zero-trust and modern device management initiatives.

Design & Operations

Implement and manage endpoint security controls: EDR/XDR (e.g., Microsoft Defender for Endpoint, CrowdStrike), DLP, disk encryption (BitLocker/FileVault), application control, USB controls, and vulnerability management. Administer Intune/Microsoft Endpoint Manager, SCCM/MECM, JAMF, or similar for policy, compliance, and posture management. Define baselines/hardening standards (CIS, Microsoft Security Baselines) and ensure configuration drift is remediated.

Threat Detection & Response

Monitor and investigate endpoint alerts; triage, contain, eradicate, and recover. Create/maintain detection rules/playbooks (SIEM/SOAR—e.g., Microsoft Sentinel, Splunk). Lead incident response for endpoint-related threats (malware, ransomware, lateral movement, persistence).

Patching & Vulnerability Management

Drive timely OS/app patching; track SLAs and risk-based prioritization. Remediate critical vulnerabilities; coordinate with platform/application owners.

Compliance & Governance

Ensure alignment with ISO 27001, SOC 2, GDPR, PCI-DSS (as applicable). Maintain asset compliance and posture reporting; support audits and evidence collection.

Automation & Improvement

Build scripts/automation (PowerShell, Python) for deployment, monitoring, and remediation at scale. Measure and improve KPIs (coverage, alert MTTR, vulnerability SLA adherence, policy compliance).

Required Qualifications

6–8 years in endpoint security/endpoint management or SOC engineering. Hands-on with EDR/XDR (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Tanium). Strong with Intune/SCCM/JAMF; Windows/macOS hardening; BitLocker/FileVault; GPOs and device compliance. Experience with SIEM (Sentinel/Splunk), KQL/SPL, alert triage, and IR workflows. Solid understanding of MITRE ATT&CK, malware/ransomware TTPs, Windows internals, and network basics. Scripting proficiency (PowerShell; Python a plus).

Preferred / Nice to Have

Experience with Zero Trust, Conditional Access, identity/device posture signals. DLP, app control (Applocker/WDAC), email security integrations (Defender for Office 365). MDM for iOS/Android, mobile threat defense. Exposure to Tanium, Qualys/Nessus, Jamf Pro, or VMware Workspace ONE. Certifications: MS-102/SC-200/SC-400, AZ-500, CompTIA Security+, CySA+, CISSP (nice to have).

Soft Skills

Strong stakeholder communication; ability to influence ops and dev teams. Analytical mindset; bias for automation and simplification. Ownership, urgency, and clear documentation.