REMOTE - Sr. Security Engineer - Identity & Endpoint

REMOTE
- Sr. Security Engineer
- Identity & Endpoint

We are a boutique IT consulting and business process outsourcing organization supporting mid to enterprise-level organizations. We are a small, but mighty, team of experts who know how to stretch, adapt, and put on any hat required in the moment to make our clients successful and enable

Fortellar’sgrowth. Keys to success at Fortellar include:

• Collaboration: Youdemonstrateexcellence in remote collaboration across your Fortellar and client teams.
• Growth Mindset: You embrace personal growth and are always learning new things to support yourteam, your clients, and your personal goals.
• Client Success: You have a passion for your client’s success – youdon’tjust deliver to the contract you ensure that your client’s goals and needs are met.
• Humanity First: Honest and transparency are your natural instincts – your actions speak louder than your words and your team members love working with you.
• Entrepreneurial: You find a way to get it done, no matter what the challenges or seeming blockers are in front of you

Job Description Summary

The Sr. Security Engineer, Identity & Endpoint designs, deploys, and operates identity, privileged access, vulnerability, endpoint, and device trust controls for Fortellar's clients, with primary assignment to large-scale, multi-workstream security remediation engagements. The role typically carries the largest and most dependency-critical share of such a program: the conditional access design this engineer produces is what gates device-compliance enforcement, and that sequence is commonly the longest critical path in the delivery plan.

Engagements involve hybrid identity estates spanning Microsoft Entra  on-premises Active Directory joined by directory synchronization, managed workstation and Windows Server estates, Microsoft Intune, and Microsoft Defender for Endpoint.

This is a hands-on engineering role with direct client exposure. The engineer is accountable for changes capable of denying access to the client's entire workforce, and is expected to exercise the judgment to pilot, stage, and where necessary halt a rollout, and to explain that decision to client stakeholders directly. The role requires deep Microsoft identity and endpoint expertise, disciplined change management, strong verbal and written communication, and the professional presence to represent Fortellar credibly in front of client technical staff and executives, both in person and virtually.

Must be able to travel 10% - 20% to client sites

Identity and Privileged Access Engineering

• Design and enforce phishing-resistant multifactor authentication for administrators and multifactor authentication for the full user population, using modern authentication methods (e.g., FIDO2 security keys, Windows Hello for Business, passkeys).
• Reduce privileged directory role membership to a justified minimum, remove dormant and stale accounts from sensitive groups, and produce the privileged-overlap map between Microsoft Entra  on-premises Active Directory.
• Remediate domain-dominance exposure, including krbtgt account rotation, removal of delegation from privileged accounts, and migration of the directory synchronization connector onto a dedicated least-privilege identity.
• Redesign Conditional Access around defined user and administrator personas and apply role-based access control, recognizing that this design is a prerequisite for device trust enforcement elsewhere in the program.
• Implement Privileged Identity Management with just-in-time elevation, and enforce sign-in frequency and non-persistent administrator sessions.
• Evaluate, select, deploy, and operate privileged access management and identity governance capability, and establish quarterly access recertification as a…