Lead Security Engineer - Workspace Security

Envestnet; India; On-site; INR 1,400,000 - 2,400,000; Full time

Job summary

Envestnet in India seeks a security specialist to elevate endpoint and workspace security across Windows, macOS, Linux, VDI, and cloud-managed devices. You will implement controls to reduce risk, enforce posture, and monitor for policy violations in development and production environments.

Candidate should bring hands-on experience with EDR/XDR, DLP, device management, and Zero Trust, plus scripting in PowerShell or Python to automate safeguards.

Qualifications

• Extensive hands-on experience securing enterprise endpoint environments across Windows, macOS, Linux, VDI and cloud-managed devices.
• Strong knowledge of endpoint hardening, baseline configurations, EDR/XDR, DLP, disk encryption, and host firewalls.
• Understanding of CIS, NIST and related enterprise security frameworks and controls.

Responsibilities

• Improve security posture of endpoints, cloud-managed devices, VDI, privileged workstations, developer environments, and SaaS-connected workspaces.
• Reduce endpoint, identity, and data security risk by implementing controls that limit lateral movement, credential misuse, unmanaged device access, and exposure of sensitive data.
• Strengthen security for high-risk user and engineering environments, including privileged access, development workflows, AI-enabled tooling, and systems that process sensitive or regulated data.
• Support secure endpoint and workspace operations through policy enforcement, posture monitoring, automation, reporting, and remediation workflows.
• Partner cross-functionally to align endpoint and workspace security controls with enterprise security standards, compliance expectations, and business needs.
• Maintain clear documentation, control evidence, runbooks, and operational procedures to support consistent execution and audit readiness.

Skills

Endpoint security

EDR/XDR & DLP

Zero Trust & identity controls

Automation scripting

Intune/Autopilot

Security baselines

Tools

PowerShell

Python

Automation tooling

Job description

• Improve the security posture of enterprise endpoints, cloud-managed devices, VDI, privileged workstations, developer environments, and SaaS-connected workspaces.
• Reduce endpoint, identity, and data security risk by implementing controls that limit lateral movement, credential misuse, unmanaged device access, and exposure of sensitive data.
• Strengthen security for high-risk user and engineering environments, including privileged access, development workflows, AI-enabled tooling, and systems that process sensitive or regulated data.
• Support secure endpoint and workspace operations through policy enforcement, posture monitoring, automation, reporting, and remediation workflows.
• Partner cross-functionally to align endpoint and workspace security controls with enterprise security standards, compliance expectations, and business needs.
• Maintain clear documentation, control evidence, runbooks, and operational procedures to support consistent execution and audit readiness.

What You Bring

• Strong hands-on experience securing and managing enterprise endpoint environments across Windows, macOS, Linux, VDI, remote workspaces, cloud-managed devices, and developer workstations.
• Deep understanding of endpoint hardening, endpoint protection technologies, device management, security baselines, EDR/XDR, DLP, disk encryption, host firewalls, application control, Intune, Autopilot, and related endpoint security tools.
• Understanding of identity-based security controls, Conditional Access, device compliance, credential protection, token protection, and Zero Trust principles.
• Experience implementing or supporting endpoint data protection controls, including encryption, DLP, CASB/SaaS policies, and monitoring for sensitive or regulated data.
• Proficiency in scripting, automation, and AI-assisted engineering using PowerShell, Python, or similar languages and tools.
• Solid understanding of endpoint hardening, compliance, and control frameworks such as CIS benchmarks, NIST standards, and related enterprise security requirements.

Nice-to-Haves

• Experience securing high-risk workstation and development environments, including Privileged Access Workstations, Endpoint Privilege Management, least-privilege access models, application control, containers, DevOps pipelines, source code platforms, build systems, engineering workstations, and AI-enabled development workflows.
• Hands-on experience with CASB or SaaS security tools such as Microsoft Defender for Cloud Apps, Zscaler, Obsidian, Netskope, or similar platforms.
• Experience with vulnerability management, patch orchestration, endpoint compliance reporting, security control deployment, and infrastructure-, configuration-, or policy-as-code approaches at enterprise scale.
• Experience supporting regulated environments or data protection requirements involving PII, PHI, PCI, intellectual property, or other sensitive data.