Senior Endpoint Security Engineer

About the Role

The Endpoint Security Engineer is a critical role responsible for safeguarding endpoints, including

desktops, laptops, servers, and mobile devices, from cyber threats. This position involves

implementing, managing, and monitoring endpoint security solutions to protect against malware,

ransomware, data breaches, and other security incidents. The Endpoint Security Engineer will

work closely with the IT and security teams to develop and enforce security policies, conduct

vulnerability assessments, and respond to security incidents. This role requires a deep

understanding of endpoint security technologies, threat landscapes, and security best practices.

The Endpoint Security Engineer will also be responsible for staying up-to-date on the latest

security threats and trends, and for recommending and implementing new security measures to

protect our organization's endpoints.

Core Objective

The primary objective of the Endpoint Security Engineer is to ensure the confidentiality, integrity,

and availability of our organization's endpoint devices and the data they contain. This involves

implementing and maintaining endpoint security solutions, such as endpoint detection and

response (EDR) systems, antivirus software, and host-based firewalls. The Endpoint Security

Engineer will also be responsible for developing and enforcing security policies and procedures,

conducting security awareness training for employees, and responding to security incidents. This

role requires a proactive approach to security, with a focus on identifying and mitigating potential

threats before they can impact our organization. The Endpoint Security Engineer will also be

responsible for collaborating with other IT and security teams to ensure a coordinated and

effective security posture.

Core Responsibilities

Malicious Code Protection:

1. Implement and manage endpoint protection platforms (EPP) and endpoint detection and response (EDR) solutions
2. Configure and maintain antivirus software and malware protection mechanisms
3. Develop and enforce policies for malicious code detection and response
4. Monitor and analyze security alerts related to malware detection
5. Conduct regular testing of malware protection systems
6. Maintain signature databases and behavioral analysis rules
7. Implement signature-based and behavioral-analysis protection mechanisms
8. Configure automatic updates for malware protection systems
9. Perform weekly full-system scans and real-time scanning of external files
10. Block or quarantine detected malicious code
11. Configure alert notifications and logging
12. Conduct monthly testing of protection mechanisms

Security Configuration Management:

1. Establish and maintain baseline security configurations for all endpoint systems
2. Implement least privilege access controls and application whitelisting
3. Manage system hardening procedures and security standards compliance
4. Oversee configuration change management processes
5. Enforce security policies for software installation and system modifications
6. Document and maintain security configuration standards
7. Implement DoD STIG-compliant security configurations
8. Configure systems for mission-essential capabilities only
9. Enforce allow-list policies for software execution
10. Maintain baseline configurations
11. Document and track configuration changes
12. Implement least functionality principles

Patch, Vulnerability & Exposure Management:

1. Coordinate vulnerability scanning and assessment programs
2. Manage patch deployment and validation processes
3. Conduct risk assessments of identified vulnerabilities
4. Prioritize and track remediation efforts
5. Maintain vulnerability management documentation
6. Collaborate with vendors on security updates and patches
7. Assess and remediate vulnerabilities based on risk level
8. Follow established change control protocols
9. Review historical logs for compromise indicators
10. Maintain patch management documentation
11. Track remediation metrics and timelines
12. Validate security updates and patches

System Observability:

1. Monitor endpoint telemetry and system performance metrics
2. Analyze system health and security events
3. Generate and review security reports and metrics
4. Maintain inventory of hardware and software assets
5. Track system resource utilization and capacity
6. Collect and analyze security and operational telemetry
7. Monitor system processor, memory, and storage utilization
8. Monitor service performance and availability
9. Generate regular system health reports

Qualifications

1. Bachelor's degree in computer science, cybersecurity, or a related field.
2. 3 + years of experience in endpoint security engineering or a related role.
3. Strong understanding of endpoint security technologies, such as EDR, antivirus,
4. host-based firewalls, and System Configuration Baselines.
5. Experience with security policy development and enforcement.
6. Knowledge of vulnerability management and penetration testing techniques.
7. Experience with incident response and remediation.
8. Familiarity with security frameworks and standards, such as NIST, ISO, and CIS.
9. Excellent analytical and problem-solving skills.
10. Strong communication and interpersonal skills.

Success Metrics

1. Reduction in endpoint security incidents
2. Improved endpoint security posture
3. Compliance with security policies and regulations
4. Effective incident response and remediation
5. Positive feedback from stakeholders

Working Relationships

1. Reports to: Manager of Cybersecurity Engineering and Risk Management
2. Direct Reports: None
3. Collaborates with: Customer Experience Team, Project Management Team, Cybersecurity Engineering Team