Endpoint Security Engineer

Role Overview

Endpoint Security

Key Responsibilities

1. Deployment, Policy & Architecture

• Architect, deploy, and optimize

  SentinelOne (EPP/EDR/XDR)

  across multi-OS endpoints (Windows, Linux distros, macOS), Virtual Desktop Infrastructures (VDI), and Kubernetes clusters (on-prem and cloud).
• Define, fine-tune, and enforce security policies balancing robust protection with operational efficiency.
• Provide deep technical expertise to resolve complex platform compatibility and performance issues.

2. Incident Response & Integration

• Partner with SOC and Incident Response teams to tune detections, investigate security incidents, and mitigate active threats.
• Develop custom automation workflows and API integrations between SentinelOne, DLP tools, and external security systems using Python, PowerShell, or Bash.
• Support network isolation strategies and OT/IoT endpoint discovery for branch and edge environments.

3. Compliance, Audit & Documentation

• Serve as a Subject Matter Expert (SME) during internal and external compliance audits (

  SOC 2 Type 1/2, PCI-DSS, ISO 27001

  , etc.).
• Author comprehensive runbooks, architecture diagrams, technical guides, and security standards.
• Conduct security training for IT and DevOps teams to encourage strong endpoint hygiene.

Requirements (Must Have)

• Experience:

  6+ years in cybersecurity, with

  69 years

  specifically architecting and supporting large-scale enterprise endpoint and DLP protection platforms.

• OS & Infrastructure Mastery:

  Hands-on administration of Linux (RHEL, Ubuntu, CentOS), Windows Server/Client, VDI (VMware, Citrix, Azure Virtual Desktop), and containerized environments (Kubernetes). Hands-on background with major cloud platforms, including AWS, Azure, and GCP.

• Automation Skills:

  Proficient in scripting (

  PowerShell, Bash, Python

  ), REST API integrations, and modern CI/CD pipelines (GitHub, GitLab, Azure DevOps).

• Security Frameworks:

  Strong familiarity with NIST, CIS Benchmarks, and the MITRE ATT&CK framework.

• Operational Readiness:

  Ability to work independently, manage high-stress incidents, and participate in occasional weekend on-call coverage or maintenance windows.

Desired Qualifications & AI Focus

• Certifications:

  SentinelOne Administrator/Engineer, DLP certifications, or industry credentials (CISSP, CISM, SANS GIAC).

• Applied AI in Security:

  Hands-on experience or strong interest in leveraging AI/ML tools (Gemini, Copilot for Security, Charlotte AI) for alert summarization, threat hunting, and automated incident triage.

• AI Governance & Risks:

  Exposure to AI-driven threats (e.g., adversarial ML, data poisoning) and awareness of frameworks like the NIST AI Risk Management Framework.

• Communication:

  Excellent presentation, technical drawing, and documentation skills with a proven track record in geographically dispersed teams.

• Education:

  Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Information Systems, or equivalent experience.