Senior Endpoint Security Engineer

View full description

Requirements:

• 5+ years in detection engineering, cyber defense, or endpoint security engineering role or equivalent experience.
• Deep hands-on experience with EDR/XDR tools (SentinelOne preferred), Cloudflare, and SIEM platforms
• Strong knowledge of endpoint security architecture, WAF rulesets, log correlation, and threat detection methodologies.
• Experience in incident response, digital forensics, and technical reporting.
• Familiar with regulatory and compliance frameworks (HIPAA, HITRUST, NIST).
• Proficient in scripting (e.g., Python, PowerShell) for automation (highly desirable).
• Relevant certifications (e.g., GCED, GCIH, CEH, or vendor-specific).

Responsibilities:

• Own and maintain the configuration and lifecycle management of SentinelOne EDR/XDR platform across all endpoints.
• Administer and tune policies in Cloudflare WAF to protect external-facing applications from OWASP Top 10 threats and targeted attacks.
• Manage and optimize SIEM platform integrations, log sources, parsing rules, alert logic, and storage.
• Design and implement custom detection rules, behavioral policies, and threat intelligence feeds for SentinelOne and SIEM.
• Monitor and triage real-time alerts from EDR/XDR, WAF, and SIEM.
• Coordinate with IT and application owners to validate findings, assess impact, and drive containment or mitigation activities.
• Conduct detailed investigations of valid security events and incidents using forensic and log analysis techniques.
• Draft and deliver post-incident reports, including timeline of events, root cause analysis, containment/remediation steps, and lessons learned.
• Work closely with IT Systems Engineering on endpoint hardening, policy enforcement (GPO/MDM), and software deployment strategy.
• Partner with GRC to support audit readiness and maintain alignment with HIPAA, HITRUST, and NIST CSF requirements.
• Support DevOps and business teams in secure application delivery and infrastructure security reviews.
• Proactively enhance detection logic and reduce false positives through continuous tuning.
• Develop automated workflows and playbooks to streamline response using SOAR or scripting where applicable.
• Assist in the development of security standards, SOPs, and hardening guides within the Endpoint Security area of ownership..