Enterprise EndpointSecurity Engineer

Endpoint security, identity, and automation for 14,000+ Windows and macOS endpoints.

• Endpoint Security Engineering
  • Build and maintain CrowdStrike Falcon policies plus PSFalcon and RTR workflows for investigation, containment, remediation, and recovery. Use RTR to repair broken security tooling when the usual management channels are unavailable.
  • Lead the enterprise ThreatLocker deployment as its primary engineer and point of contact. Own policy design, Ringfencing, Secure Mode, application control, rollout decisions, agent recovery, and platform troubleshooting across the fleet.
• Device Management and Identity
  • Manage macOS MDM (Jamf Pro), including system extensions, launchd services, security-tool deployment, and compliance remediation.
  • Design and implement Intune, Entra ID, and Exchange Online controls for device, identity, and application access.
  • Administer Palo Alto Networks GlobalProtect policies through Strata Cloud Manager to support secure remote access across the enterprise fleet.
• Automation and Rollouts
  • Automate endpoint, identity, and Microsoft 365 administration with PowerShell, Python, Bash, Microsoft Graph, and REST APIs.
  • Lead the migration from Delinea to Bitwarden. Own policy design, Entra ID onboarding groups, SCIM provisioning, SSO, use-case documentation, and the ServiceNow rollout plan.

Led EDR engineering and automation in an MSP/MSSP environment with 17,000+ endpoints across 700+ tenants. Served as the Tier 3 escalation point for endpoint investigations and difficult agent failures.

• EDR Engineering & Response
  • Managed SentinelOne policies, STAR rules, exclusions, and indicator blocklists across the multi-tenant fleet.
  • Designed configurable network quarantine policies in SentinelOne, using JSON allowlists for essential services (DNS/DHCP/DC) to avoid outages.
  • Led CrowdStrike Falcon onboarding with Flight Control and parent/child CIDs. Wrote PowerShell scripts with PSFalcon to migrate policies across tenants.
• Automation and Recovery
  • Built the SentinelOne AIO Toolkit, a PowerShell tool used to purge, install, roll back, and recover unhealthy agents at scale.
  • Created Falcon Fusion workflows with Microsoft Teams for host isolation approvals, plus Microsoft Graph automation for Azure app registration.
• Application Control and Visibility
  • Managed ThreatLocker Ringfencing and reviewed unknown binaries before approving execution.
  • Standardized Horizon3.ai NodeZero assessments and routed firewall telemetry through Cribl into Splunk.

Administered a VPN platform spanning six regions, with responsibility for Linux systems, network security, and incident response.

• Managed Debian and RHEL systems, including patching, SSH access, service reliability, and host firewall policy.
• Designed L3/L4 DDoS protection using Cloudflare Magic Transit and GRE tunnels for latency-sensitive services.
• Diagnosed production issues through logs, process inspection, and configuration review; applied ACLs and rate limits during incidents.

Handled Tier 3 AppleCare escalations for complex macOS and iOS issues involving account security, data integrity, device trust, crashes, and performance.

• Used logs and structured troubleshooting to isolate software and system failures.
• Coached advisors through escalations and documented unusual defects for engineering and internal knowledge systems.