Remote Endpoint Security Engineer – TS/SCI

Castalia Systems; Morrisville (NC); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

401k matching

Generous PTO

Paid holidays

Professional training opportunities

Pet insurance

Job summary

Castalia Systems is seeking an Endpoint Security Engineer to design, deploy, and operationalize active, behavior-based EDR/XDR across a large enterprise footprint in North America. You will balance proactive protection with business continuity, partnering with end-users and owners to tune policies and reduce friction while providing tier-3/4 escalations to SOC and IT Operations during investigations.

You will lead the deployment of NGAV/EDR agents, define baseline behaviors, and extend security

Qualifications

• Minimum 7+ years in technical cybersecurity engineering or infrastructure security roles.
• 3–5 years engineering and administering enterprise EDR/XDR across 50,000+ endpoints in a hybrid environment.
• Bachelor’s degree or equivalent enterprise experience.
• EDR/XDR engineering across Windows, macOS, Linux, and containers.
• Behavioral IOAs, Sysmon telemetry, and threat hunting with SQL, KQL, Splunk SPL or YARA.

Responsibilities

• Engineer, deploy, and maintain NGAV/EDR/XDR across hundreds of thousands of endpoints.
• Implement protections against zero-day malware, LotLBs, fileless execution, and credential dumping.
• Partner with application owners to establish baseline behavior and minimize false positives.
• Lead endpoint security escalation during high-severity SOC events; assist IT operations during investigations.
• Perform host forensics, memory analysis, and live remediation across multi-cloud environments.

Skills

EDR/XDR engineering

Windows/macos/linux

PowerShell

Python

Bash

SQL

KQL

Splunk SPL

YARA

Threat hunting

Automation

Education

Bachelor's degree in CS/Cybersecurity/Info Systems

Job description

Castalia Systems is seeking an Endpoint Security Engineer to design, deploy, and operationalize active, behavior-based EDR/XDR across a large enterprise footprint in North America. You will balance proactive protection with business continuity, partnering with end-users and owners to tune policies and reduce friction while providing tier-3/4 escalations to SOC and IT Operations during investigations.

You will lead the deployment of NGAV/EDR agents, define baseline behaviors, and extend security