Endpoint Security Engineer (EDR/XDR)

NikSoft Systems Corporation; United States; On-site; USD 140,000 - 180,000; Full time

Job summary

NikSoft Systems Corporation seeks a Lead Endpoint Security Engineer to design, deploy, and operationalize a behavioral defense infra across one of North America’s largest private fleets. You’ll balance aggressive threat mitigation with business continuity for 600k+ employees and 30k sites, while supporting hybrid cloud environments.

You will lead tier-3/4 escalation, improve detection, and drive automation with an IaC mindset to scale policy compliance and response.

Qualifications

• 7+ years in progressive cybersecurity/infrastructure roles across large environments.
• 3-5 years directly engineering EDR/XDR platforms across 50,000+ endpoints in a distributed hybrid env.
• Deep mastery of Windows/Linux internals and threat hunting languages (KQL/SPL/SQL).
• Automation scripting with Python, PowerShell, and Bash.
• Experience leveraging AI/ML analytics platforms to streamline security activities.

Responsibilities

• Fleet-wide defense engineering: implement and maintain next-gen endpoint protection across diverse devices and multi-cloud workloads.
• Business impact management: align security controls with application owners to minimize downtime.
• Incident escalation & forensics: lead high-severity threats with host forensics and automated remediations.
• Continuous control validation: run BAS and purple team exercises to measure control efficacy.
• Scale automation: adopt Infrastructure-as-Code to enforce policy compliance and automation.

Skills

EDR/XDR engineering

Threat hunting

Windows/Linux internals

KQL/SPL/SQL

Python

PowerShell

Bash

Cloud security

Education

Bachelor's degree in Computer Science, Cybersecurity, or equivalent

Tools

CrowdStrike

Defender

SentinelOne

Splunk

Databricks

Elastic

Job description

We are seeking a Lead Endpoint Security Engineer to design, deploy, and operationalize our behavioral defense infrastructure across one of the largest private operational fleets in North America. Protecting over 600,000 employees and 30,000 physical sites, you will balance aggressive, zero-day threat mitigation with flawless business continuity.

In this role, you will eliminate operational friction for our retail, logistics, and multi-cloud environments, while serving as the ultimate tier-3/tier-4 technical escalation point for active security investigations.

Key Responsibilities

• Fleet-Wide Defense Engineering: Manage and maintain next-gen endpoint platforms (e.g., CrowdStrike, Defender, SentinelOne) across hundreds of thousands of heterogeneous devices, servers, and multi-cloud (AWS, Azure, GCP) workloads.
• Business Impact Management: Partner directly with application owners to establish baseline behavior profiles, managing allowlisting and phased ring deployments to prevent downtime across mission-critical logistics software.
• Incident Escalation & Forensics: Act as the technical lead during high-severity threats; perform advanced host forensics, process-tree reconstruction, and script-based automated remediations.
• Continuous Control Validation: Run Breach and Attack Simulations (BAS) and Purple Team exercises to continuously test, measure, and report on security control efficacy.
• Scale Automation: Leverage an "Infrastructure-as-Code" mindset to orchestrate fleet-wide policy compliance and event response through automation rather than manual device intervention.

Qualifications

• Experience: 7+ years in progressive cybersecurity/infrastructure roles, including 3-5 years directly engineering EDR/XDR platforms across 50,000+ endpoints in a distributed hybrid environment.
• Core Technical Skills: Deep mastery of Windows/Linux OS internals, threat hunting query languages (KQL, SPL, SQL), and automation scripting (Python, PowerShell, Bash).
• Modern Tech Savvy: Fluency in leveraging AI/ML analytics platforms (Splunk, Databricks, Elastic) to streamline data research, documentation, and automated security activities.
• Soft Skills: Exceptional crisis leadership and a high degree of stakeholder empathy to balance strict security with operational velocity.
• Education: Bachelor's degree in Computer Science, Cybersecurity, or equivalent practical enterprise experience.

Preferred Certifications

• CISSP, GCED, GCIH, or GCFA.

****Candidates must be able to obtain a Postal Sensitive Clearance (US Citizenship or Green Card required). Additionally, candidates must not have traveled outside of the USA for a combined period not to exceed 6 months within the last 3 years.***