Information Security Engineer

Intuitive; Peachtree Corners (GA); On-site; USD 90,000 - 130,000; Full time

Job summary

Intuitive is seeking an IT Security Analyst to join the security operations team, focusing on DLP, EDR, incident management orchestration, and security automation across Windows, macOS, and Linux.

The role requires tuning DLP policies, deploying EDR agents, building automated workflows with SOAR, and supporting ZTNA enforcement to strengthen the organization’s security posture. Collaboration with Detection Engineering and Incident Response is expected.

Qualifications

• Experience with data loss prevention (DLP), endpoint security (EDR), SOAR automation, and SIEM.
• Familiarity with zero trust network access (ZTNA) architectures and policies.
• Strong incident response coordination and policy enforcement skills.

Responsibilities

• Administer and tune DLP policies across endpoints and cloud apps.
• Deploy and troubleshoot EDR agents on Windows, macOS, and Linux.
• Build automated incident response workflows using SOAR platforms.
• Support ZTNA policy enforcement in coordination with Network Security.
• Investigate DLP alerts, perform root cause analysis, and document findings for audits.
• Classify and prioritize endpoint security events by severity and impact.
• Develop operational metrics and dashboards to track policy effectiveness and response performance.
• Collaborate with Detection Engineering to refine SIEM rules addressing bypass techniques and evasion.
• Support incident lifecycle with forensic data and automation assistance.

Job description

Job Description

Primary Function of the Position

This position operates within the IT Security organization and focuses on data loss prevention (DLP), endpoint detection and response (EDR), incident management orchestration, security automation, and zero trust network access (ZTNA). The analyst administers and tunes DLP policies, triages and responds to endpoint security events across Windows, macOS, and Linux, builds automated response workflows, and contributes to the continuous improvement of Intuitive’s security posture. Responsible for protecting company information, systems, and users from data exfiltration, unauthorized access, and threat exposure.

Essential Job Duties

• Administer, tune, and maintain DLP policies and rules within enterprise DLP and SASE/CASB platforms to prevent unauthorized data exfiltration across endpoints, cloud applications, and network egress points.
• Deploy, configure, and troubleshoot EDR agents across Windows, macOS, and Linux endpoints, ensuring consistent sensor health, policy enforcement, and telemetry collection.
• Build and maintain automated incident response and orchestration workflows using SOAR platforms to accelerate alert triage, enrichment, containment, and escalation across the security tooling stack.
• Support ZTNA policy implementation and enforcement in coordination with Network Security, ensuring least-privilege access controls align with zero trust architecture principles.
• Investigate and respond to DLP alerts, performing root cause analysis, classifying data at risk, coordinating with business stakeholders on policy exceptions, and documenting findings for compliance and audit purposes.
• Triage and classify endpoint security events by severity and business impact, correlating telemetry from EDR, SIEM, and DLP platforms to identify threats and data exposure risks.
• Perform endpoint troubleshooting across Windows, macOS, and Linux, including agent deployment issues, policy conflicts, OS-specific behavioral anomalies, and sensor communication failures.
• Develop and refine operational metrics and dashboards in Elasticsearch to track DLP policy effectiveness, endpoint coverage gaps, automation ROI, and incident response performance.
• Collaborate with Detection Engineering to create and tune SIEM detection rules that address DLP bypass techniques, EDR evasion, and insider threat indicators.
• Partner with Incident Response and Investigations teams during escalated security events, providing endpoint forensic data, DLP event context, and automation support throughout the incident lifecycle.
• Conduct and support internal security investigations, including insider threat cases, policy violations, and unauthorized data handling, using DLP, EDR, and SIEM platforms for evidence collection and forensic analysis.
• Maintain strict confidentiality and discretion when handling sensitive investigation materials, personnel matters, and privileged findings throughout the investigative lifecycle.