Senior Security Engineer - Identity & Endpoint

Description

You will be a hands-on senior engineer who leads technical projects, works across teams, and mentors others in the security engineering group.

The role sits inside a layered defense program and covers the design, rollout, and tuning of AI-enabled security tools at every layer, with automation, detection, response, and hardening as core goals.

You will work with the Senior Manager of Enterprise Security and engineering teams to shrink the attack surface, adapt to new threats, and shorten detection and response times across the company's technical environment.

Your main focus is identity and endpoint security: the controls that protect user and privileged identities, devices, and access across the enterprise.

Responsibilities

• Deploy, tune, and run EDR and XDR platforms, writing custom detections and automated responses across security tools.
• Own the rollout and enforcement of endpoint and image hardening baselines, along with configuration and application control standards.
• Feed endpoint telemetry into the SIEM or central analytics platform, and confirm that coverage is adequate and effective.
• Act as the technical escalation point for endpoint events, exposures, vulnerabilities, and alerts, and drive fixes within SLAs with other teams.
• Run complex endpoint investigations to root cause: triage, collect memory, disk, and log artifacts, rebuild timelines, and contain and eradicate threats.
• Lead the design, rollout, integration, and tuning of identity controls for workforce, privileged, service, and machine identities.
• Build and maintain identity governance, SSO, MFA, conditional access, privileged access management, just-in-time access, secrets management, and identity threat detection and response.
• Apply least-privilege, role-based and attribute-based access, segregation of duties, and joiner, mover, and leaver lifecycle controls.
• Send identity, authentication, authorization, and privileged access telemetry into the SIEM to support correlation, investigation, and automated response.
• Lead root-cause work and coordinated fixes for identity attacks, anomalous access, credential compromise, privilege misuse, and authorization failures.
• Automate provisioning, access certification, policy enforcement, control checks, and response using APIs, scripts, workflow orchestration, and policy-as-code.
• Work with IAM, IT, security, engineering, and application owners to build secure identity patterns, fix access risks, and make controls easier to use.
• Track identity measures including authentication coverage, privileged access reduction, access review completion, policy compliance, control health, detection quality, and remediation speed.
• Lead the design and rollout of controls across perimeter, network, host, application, identity, and data layers, and keep each layer effective.
• Shape and enforce control standards and design patterns based on recognized industry frameworks, acting as subject matter expert during build and review.
• Check that telemetry from every layer reaches central analytics and gives full visibility and coverage.
• Reassess control effectiveness regularly as systems grow and threats change, then propose and build extra coverage.
• Lead purple team exercises and control testing to prove depth and resilience under attack.
• Build redundant, overlapping controls so that one bypass or failure does not open a gap.
• Lead structured hunts and purple team work with the Purple Team, analyzing telemetry for anomalous and malicious behavior and reporting results to stakeholders.
• Plan, run, and document hunts mapped to MITRE ATT&CK and ATLAS and current threat intelligence.
• Analyze exposure from vulnerabilities, zero-days, alerts, threat intelligence, and partner or customer notices, and judge exploitability and risk.
• Track the threat landscape, adversary tactics, and new vulnerabilities for their relevance to the company's systems and direction.
• Standardize hunt methods, hypotheses, and results, and help grow the threat hunting program with the Purple Team.
• Turn successful hunts, exposure work, and purple team results into lasting automated detections and containment logic.
• Build and maintain SOAR workflows for enrichment, triage, containment, and routine response, and help shape the automation roadmap.
• Measure how automation affects detection, containment, and response times, and keep improving it to cut attacker dwell time.
• Evaluate and deploy AI and ML for semantic anomaly detection, behavioral analytics, and alert triage and prioritization, and advise on tool choices.
• Implement and run data classification, discovery, and data security posture management across cloud and on-premises stores.
• Deploy and tune DLP controls across endpoints, network, email, cloud, and SaaS.
• Investigate data risk indicators tied to access and exfiltration, and feed data telemetry into the SIEM.
• Mentor junior and mid-level engineers on approach, tools, and growth, and act as their day-to-day escalation point.
• Lead technical design for assigned initiatives and write clear documentation, runbooks, and knowledge articles for the team.
• Take part in hiring, including technical interviews and candidate assessments.
• Represent the security engineering team in cross-functional technical discussions, explaining requirements and findings to engineers and non-technical stakeholders.

Requirements

• You have 4 to 8 years of hands-on enterprise security engineering experience, focused on endpoints and identity.
• You have used EDR, XDR, SIEM, CNAPP, CSPM, and CWP tools, and you understand security technologies at all OSI layers.
• You have experience in threat hunting, digital forensics, or detection engineering, including writing automation scripts and rules.
• You have solid knowledge of common security benchmarks and frameworks such as MITRE and NIST.
• You are expert in at least one of Python, Bash, or PowerShell, applied to containerized services, CLI commands, or security work.
• You have owned complex security initiatives end to end, coordinating across teams, communicating with stakeholders, and delivering technical results.
• You explain technical findings clearly to both engineering peers and non-technical stakeholders.
• You hold a certification such as SSCP, Security+, or an equivalent.
• You have previously mentored or guided junior engineers.
• Required skills: access management, application security, endpoint security, network security, penetration testing, security architecture design, SIEM, security operations, and vulnerability management.
• Preferred: a bachelor's degree in computer science, information security, or equivalent experience.
• Preferred: experience with AI-enabled SecOps, such as UEBA, ML-based alert prioritization, or AI-assisted threat hunting.
• Preferred: working knowledge of AWS, Azure, or GCP.
• Preferred: experience adding endpoint or network security controls to CI/CD pipelines and infrastructure-as-code environments.
• Preferred: experience supporting SOC 2, ISO 27001, or HIPAA compliance from a technical control perspective.

Conditions

Hybrid or remote work.

Benefits

• A competitive base salary between $130,000 and $195,000.
• An annual performance bonus and long-term incentives as part of total compensation.
• Final pay depends on experience, skills, qualifications, and internal pay equity; offers at the top of the range are not typical, to leave room for future pay growth.