Information Security Engineer II - End Point

Job Description

SUMMARY

The Information Security Engineer II is responsible for the day-to-day operations, maintenance, and continuous improvement of the organization's endpoint security program. This role centers on the administration of Extended Detection and Response (EDR) technologies, primarily Crowd Strike Falcon, encompassing agent lifecycle management, policy configuration, alert response, threat hunting, and platform reporting. The engineer will manage endpoint firewall policies within Crowd Strike and administer Data Loss Prevention (DLP) solutions including Digital Guardian and/or Microsoft Purview to protect sensitive organizational data.

Additionally, this role supports the development and maintenance of secure endpoint baseline configurations aligned to CIS Level 1 Benchmarks. The engineer will provide backup support for vulnerability management functions and will have exposure to complementary security technologies including Palo Alto Next-Generation Firewalls, Forescout Counter Act (Network Access Control), and Mimecast email security. This position operates within a collaborative security team and contributes to the broader corporate security strategy, supporting compliance requirements such as FFIEC, PCI DSS, GDPR, and SOX.

MAJOR DUTIES AND RESPONSIBILITIES (ESSENTIAL FUNCTIONS)

• Administer, configure, and maintain the Crowd Strike Falcon platform, including agent deployment, agent version management, policy configuration, group management, and sensor health/hygiene across Windows, macOS, and Linux endpoints.
• Monitor and triage EDR alerts, investigate potential threats and indicators of compromise (IOCs), and drive containment, remediation, and root cause analysis activities.
• Conduct proactive threat hunting using EDR telemetry, behavioral analytics, and threat intelligence feeds to identify adversarial activity that may evade automated detections.
• Stay current with Crowd Strike product updates, new module releases, and emerging features; evaluate and implement relevant capabilities to strengthen the security posture.
• Manage and maintain a robust endpoint firewall policy set within the Crowd Strike platform, including rule creation, tuning, exception handling, and ongoing policy reviews.
• Implement, operate, and maintain Data Loss Prevention (DLP) solutions on the endpoint, including Digital Guardian and/or Microsoft Purview, ensuring policies are configured to detect and prevent unauthorized data exfiltration or transfer.
• Administer DLP policies, perform alert triage and investigation, tune detection rules to reduce false positives, and collaborate with data owners and legal/compliance teams on policy enforcement.
• Contribute to the development and maintenance of secure endpoint baseline images and configurations, aligning to CIS Level 1 Benchmarks and organizational hardening standards.
• Support vulnerability management operations, including configuring and executing credentialed vulnerability scans (e.g., Qualys/Tenable), reviewing scan results, prioritizing vulnerabilities based on risk, and coordinating remediation with IT teams.
• Assist with Palo Alto Networks Next-Generation Firewall (NGFW) operations, including rule review, policy tuning, and troubleshooting as needed.
• Support Forescout Counter Act operations, including policy management, device profiling, and remediation workflows.
• Assist with Mimecast email security administration, including policy configuration, threat response, and user support.
• Document security processes, procedures, configurations, alert triage activities, and investigation findings to support compliance, audit, and knowledge management requirements.
• Participate in change management processes and ensure security controls are assessed prior to changes impacting endpoint environments.
• Collaborate with outsourced Security Operations Center (SOC) analysts, IT teams, and third-party vendors to coordinate endpoint security efforts and escalate incidents as appropriate.
• Support compliance with applicable regulatory frameworks (e.g., FFIEC, PCI DSS, CRI Profile) through proper configuration, documentation, and evidence collection.
• Produce operational reports and metrics…