Information Security Engineer

In the IT Security organization at Intuitive Surgical, this role administers and optimizes DLP controls, manages EDR operations and incident response orchestration, and supports zero trust network access enforcement across endpoints, cloud, and network environments.

• Administer, tune, and maintain DLP policies and rules within enterprise DLP and SASE/CASB platforms to prevent unauthorized data exfiltration across endpoints, cloud applications, and network egress points.
• Deploy, configure, and troubleshoot EDR agents across Windows, macOS, and Linux to ensure consistent sensor health, policy enforcement, and telemetry collection.
• Build and maintain SOAR
  -driven automated incident response and orchestration workflows to support faster alert triage, enrichment, containment, and escalation.
• Coordinate with Network Security to implement and enforce ZTNA policy controls, aligning least-privilege access with zero trust architecture principles.
• Investigate and respond to DLP alerts
  , conduct root cause analysis, classify data at risk, coordinate with business stakeholders on policy exceptions, and document findings for compliance and audit needs.
• Triage and classify endpoint security events by severity and business impact, correlating telemetry from EDR, SIEM, and DLP systems to identify threats and data exposure risks.
• Perform endpoint troubleshooting across Windows, macOS, and Linux
  , including agent deployment issues, policy conflicts, OS-level behavioral anomalies, and sensor communication failures.
• Develop and refine operational metrics and dashboards in Elasticsearch to track DLP policy effectiveness, endpoint coverage gaps, automation ROI, and incident response performance.
• Collaborate with Detection Engineering to create and tune SIEM detection rules addressing DLP bypass techniques, EDR evasion, and insider threat indicators.
• Support Incident Response and Investigations teams during escalated security events by providing endpoint forensic data, DLP event context, and automation support throughout the incident lifecycle.
• Conduct and support internal security investigations, including insider threat cases, policy violations, and unauthorized data handling, using DLP, EDR, and SIEM platforms for evidence collection and forensic analysis.
• Maintain strict confidentiality and discretion when handling sensitive investigation materials, personnel matters, and privileged findings throughout the investigative lifecycle.

• Minimum 2 years of experience.
• Hands-on experience administering and tuning enterprise DLP and SASE/CASB solutions across endpoint, cloud, and network enforcement points.
• Experience deploying, managing, and troubleshooting EDR platforms across Windows, macOS, and Linux
  .
• Demonstrated competence in endpoint troubleshooting across Windows, macOS, and Linux
  , including agent lifecycle management, OS-level diagnostics, and policy conflict resolution.
• Understanding of OS internals for Windows, macOS, and Linux
  , including file systems, process management, registry/plist configuration, logging subsystems, and kernel-level behaviors relevant to security tooling.
• Working knowledge of ZTNA concepts and technologies, including identity-aware access controls, micro-segmentation, and least-privilege network policies.
• Experience building security automation and orchestration workflows using SOAR platforms for incident triage, enrichment, and response.
• Familiarity with SIEM platforms and Elasticsearch for log analysis, alert correlation, and dashboard development.
• Strong communication skills to convey technical findings to IT teams, engineering stakeholders, and business partners in a matrixed organization.
• Demonstrated ability to handle sensitive and confidential…