Endpoint Security Engineer

Job Title: Endpoint Security Engineer (Senior)

Role Summary
Own and strengthen endpoint security across Windows, macOS, Linux, and mobile platforms. Drive protection, detection, response, and compliance by designing controls, operating EDR/XDR tooling, and partnering with IT operations for patching and hardening. Contribute to zero-trust and modern device management initiatives.
Key Responsibilities

Design & Operations

Implement and manage endpoint security controls: EDR/XDR (e.g., Microsoft Defender for Endpoint, CrowdStrike), DLP, disk encryption (BitLocker/FileVault), application control, USB controls, and vulnerability management.
Administer Intune/Microsoft Endpoint Manager, SCCM/MECM, JAMF, or similar for policy, compliance, and posture management.
Define baselines/hardening standards (CIS, Microsoft Security Baselines) and ensure configuration drift is remediated.

 

Threat Detection & Response

Monitor and investigate endpoint alerts; triage, contain, eradicate, and recover.
Create/maintain detection rules/playbooks (SIEM/SOAR—e.g., Microsoft Sentinel, Splunk).
Lead incident response for endpoint-related threats (malware, ransomware, lateral movement, persistence).

 

Patching & Vulnerability Management

Drive timely OS/app patching; track SLAs and risk-based prioritization.
Remediate critical vulnerabilities; coordinate with platform/application owners.

 

Compliance & Governance

Ensure alignment with ISO 27001, SOC 2, GDPR, PCI-DSS (as applicable).
Maintain asset compliance and posture reporting; support audits and evidence collection.

 

Automation & Improvement

Build scripts/automation (PowerShell, Python) for deployment, monitoring, and remediation at scale.
Measure and improve KPIs (coverage, alert MTTR, vulnerability SLA adherence, policy compliance).

 

Required Qualifications

6–8 years in endpoint security/endpoint management or SOC engineering.
Hands-on with EDR/XDR (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Tanium).
Strong with Intune/SCCM/JAMF; Windows/macOS hardening; BitLocker/FileVault; GPOs and device compliance.
Experience with SIEM (Sentinel/Splunk), KQL/SPL, alert triage, and IR workflows.
Solid understanding of MITRE ATT&CK, malware/ransomware TTPs, Windows internals, and network basics.
Scripting proficiency (PowerShell; Python a plus).

Preferred / Nice to Have

Experience with Zero Trust, Conditional Access, identity/device posture signals.
DLP, app control (Applocker/WDAC), email security integrations (Defender for Office 365).
MDM for iOS/Android, mobile threat defense.
Exposure to Tanium, Qualys/Nessus, Jamf Pro, or VMware Workspace ONE.
Certifications: MS-102/SC-200/SC-400, AZ-500, CompTIA Security+, CySA+, CISSP (nice to have).

Soft Skills

Strong stakeholder communication; ability to influence ops and dev teams.
Analytical mindset; bias for automation and simplification.
Ownership, urgency, and clear documentation.