Lead Cybersecurity Engineer
Role Summary
The Lead – System Security is responsible for leading the design, engineering, deployment, and ongoing operation of enterprise system and endpoint security platforms, with a primary focus on SCCM-based security agent deployment, Microsoft Exchange Online Protection (EOP), and SentinelOne endpoint protection.
This role acts as a platform owner and technical authority for system-level security controls, ensuring secure, scalable, and compliant deployment of endpoint and email security capabilities across the enterprise. The role partners closely with Endpoint, IAM, SOC, Network, and GRC teams to embed security-by-design and support Zero Trust objectives.
Key Responsibilities
System & Endpoint Security Platform Ownership
- Own and lead enterprise system and endpoint security platforms including SCCM / Endpoint Configuration Manager, SentinelOne, and Microsoft EOP
- Define architecture standards, deployment models, and configuration baselines for system and endpoint security controls
- Ensure high availability, scalability, and operational health of system security services across the enterprise
Endpoint Protection & Agent Engineering (SentinelOne)
- Lead deployment, configuration, and lifecycle management of SentinelOne EDR agents
- Ensure endpoint coverage, policy compliance, threat prevention effectiveness, and performance optimization
- Partner with SOC teams to support alert tuning, threat investigation, and response workflows
- Drive endpoint hygiene initiatives and continuous improvement of endpoint security posture
System Management & Secure Deployment (SCCM)
- Lead SCCM-based deployment of security agents, system hardening configurations, and endpoint controls
- Engineer scalable, automated deployment workflows for Windows and supported platforms
- Ensure reliable patching, upgrade, and rollback strategies for security agents and system components
- Support endpoint inventory, health monitoring, and compliance reporting
Email & Messaging Security (Microsoft EOP)
- Own configuration and optimization of Microsoft Exchange Online Protection (EOP)
- Tune anti-phishing, anti-malware, and spam protection policies to reduce email-borne threats
- Support secure email workflows and incident response for phishing and email-based attacks
- Partner with GRC and Compliance teams to ensure email security controls meet regulatory requirements
Incident Support, Compliance & Governance
- Provide L3 support for system and endpoint security incidents and escalations
- Ensure alignment of system security controls with regulatory and compliance frameworks (HIPAA, NIST, ISO)
- Support audits, risk assessments, and security architecture reviews with technical inputs
- Maintain standards, runbooks, and operational documentation
Leadership & Continuous Improvement
- Provide technical leadership and mentorship to system and endpoint security engineers
- Act as an escalation point for complex system security issues
- Drive automation, process optimization, and platform maturity initiatives
- Identify opportunities to improve security coverage, performance, and user experience
Required Skills & Experience
- 6–8+ years of experience in system security, endpoint security, or security engineering roles
- Strong hands-on experience with SentinelOne EDR
- Strong hands-on experience with SCCM / Endpoint Configuration Manager
- Experience managing Microsoft Exchange Online Protection (EOP)
- Solid understanding of endpoint security, EDR, email security, and system hardening concepts
- Experience operating in large, enterprise-scale environments
- Strong troubleshooting, documentation, and stakeholder communication skills
Preferred Qualifications
- Experience in healthcare or other highly regulated environments
- Certifications related to endpoint or system security (Microsoft, SentinelOne, security certifications)
- Experience integrating endpoint security platforms with SIEM/SOC tooling
- Familiarity with Zero Trust and endpoint security architecture patterns
Key Success Metrics
- Stable and secure operation of SentinelOne, SCCM, and EOP platforms
- High endpoint coverage and policy compliance
- Reduction in endpoint- and email-based security incidents
- Improved deployment reliability and agent health
- Strong satisfaction from Endpoint, SOC, and IT stakeholders
