Endpoint Security Engineer
HUB International2 days ago
Base Salary
$130k - $140k/yr
Responsibilities
- Own the enterprise EDR platform, including deployment coverage, agent health, policy tiers, configuration, availability, and lifecycle management.
- Design, document, tune, and govern endpoint security policies, exclusions, detections, and prevention controls.
- Monitor and remediate unhealthy, outdated, unmanaged, or policy-drifted endpoints in partnership with IT.
- Review endpoint alerts, investigate threats, reduce false positives, and support containment, remediation, and incident response.
- Assess acquired organizations’ EDR platforms and produce parity matrices, gap analyses, risk summaries, and integration recommendations.
- Plan and stage agent upgrades, policy changes, and console configuration changes using pilot rings and change-management practices.
- Maintain endpoint automation, SIEM and SOAR integrations, reporting, support cases, and platform roadmap tracking.
- Support security standards, audits, risk assessments, compliance reviews, and endpoint security architecture development.
Requirements
- Bachelor’s degree in technology or applicable experience.
- At least 5 years of experience in information security operations or engineering, including at least 3 years administering and engineering enterprise EDR platforms.
- Hands-on experience with a leading enterprise EDR platform and enterprise-scale endpoint policy and exclusion management.
- Experience assessing, integrating, or migrating between EDR/XDR products and mapping configuration and policy equivalency; M&A security integration experience is preferred.
- Strong knowledge of Windows, macOS, and Linux internals, endpoint attack techniques, and MITRE ATT&CK.
- Experience with endpoint deployment and management tools, Active Directory, and MS Entra ID.
- At least 3 years of security incident response and operations experience involving endpoint investigation, containment, and remediation.
- At least 3 years of experience with AWS, GCP, Azure, and O365 services and technology.
- At least 2 years of experience defining, refining, and improving operational processes.
- Experience with SIEM, SOAR, KQL, SPL, EDR threat-hunting query languages, PowerShell, Python, shell scripting, and REST APIs.
- Working knowledge of TCP/IP, DNS, Windows Event logging, email authentication, and security and compliance standards including ISO 27001, NIST 800-53, SOC 2, PCI, and SOX.
- Related certifications such as EDR platform administrator certifications, GSEC, GCIH, GCFE/GCFA, CISSP, or AWS are preferred.
- Strong prioritization, decision-making, critical-thinking, documentation, communication, and relationship-building skills.
Benefits
- Expected base salary is $130,000-$140,000.
- Health, dental, vision, life, and disability insurance are offered.
- FSA, HSA, 401(k) accounts, retirement savings matching, and company-paid life and disability plans are available.
- Benefits include paid vacation, sick and personal days, paid parental leave, and a wellbeing program.
- The company offers eligible bonuses, equity, and commissions for some positions.
- HUB provides structured training, licensing support, ongoing development, and career-growth opportunities.
About HUB International
HUB International is a global insurance brokerage that sells commercial and personal insurance, risk management, employee benefits, retirement, and wealth advisory services to businesses and individuals. It operates through offices across North America and generates revenue primarily from brokerage commissions and fees. Headquartered in Chicago, it is privately held and backed by private equity firm Hellman & Friedman, with origins dating to the late 1990s through the merger of regional brokerages.