Security Engineer II (Endpoint Security)

collegeboard; United States; Remote; USD 110,000 - 150,000; Full time

Job summary

College Board is seeking a Security Engineer II, Endpoint Security, to own the ongoing engineering of the application allowlist, ensuring only approved software runs on managed endpoints. You will extend coverage as needs evolve, adjust policy for new device groups, and process exceptions while keeping enforcement current and low-friction for the business.

This role partners with IT, application owners, and business-unit stakeholders to maintain an accurate allowlist continuously.

Qualifications

• 2 to 4 years of cybersecurity/endpoint security experience.
• Experience with endpoint management and application control concepts.
• Experience processing exceptions or access requests against defined criteria.
• Strong communication with end users and stakeholders about software approvals and restrictions.
• Strong documentation and audit-ready record keeping.
• Authorization to work in the United States.

Responsibilities

• Allowlist policy engineering and coverage (50%). Maintain and extend the allowlist baseline as software, vendors, and business needs change.
• Define and adjust allowlist enforcement tiers and rollout sequencing as new device groups or business units come online.
• Test and validate allowlist policy changes before enforcement to minimize business disruption.
• Track and report on device coverage, blocked installs, and open risks.

Skills

Endpoint security

Exception handling

Documentation

Stakeholder communication

Learning security tools

Education

Security+ certification

Tools

Intune

Tanium

Carbon Black

AppLocker

Job description

College Board - Technology - Security

Location:

This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes.

Type:

Full-time position

About the Team

Enterprise Security Engineering (ESE) is the security team responsible for building and operating the foundational security platforms and controls that protect College Board's enterprise environment. The team owns a broad capability surface spanning security observability, endpoint security, network and edge security, data security, security review management, and AI security. ESE is both an engineering team and a standards-setting function. The team designs, builds, and operates the controls that protect College Board's workforce, data, and systems, and it owns the enterprise security standards that operationalize information security policies across the organization. The team partners across security, Technology, and other organizational divisions to deliver integrated, measurable security outcomes. ESE engineers are technical owners who drive measurable risk reduction through automation, disciplined platform operations, and continuous improvement.

About the Opportunity

As a Security Engineer II, Endpoint Security, you will own the ongoing engineering of College Board's application allowlist, ensuring only approved software runs on managed endpoints. You will maintain and extend allowlist coverage as software, vendors, and business needs evolve, define and adjust policy as new device groups come online, and process exception requests as they arise. Application allowlisting is a standing control, not a one-time project - it requires continuous engineering to stay effective as the environment changes, and you will make an immediate impact by keeping enforcement current, accurate, and low-friction for the business.

This role partners closely with IT, application owners, and business-unit stakeholders whose software needs must be captured and reflected in the allowlist on an ongoing basis.

In this role, you will:

• Allowlist Policy Engineering and Coverage (50%)
  • Maintain and extend the application allowlist baseline as software, vendors, and business needs change
  • Define and adjust allowlist enforcement tiers and rollout sequencing as new device groups or business units come online
  • Test and validate allowlist policy changes before enforcement to minimize business disruption
  • Track and report on device coverage, blocked installs, and open risks
• Exception Handling and Policy Maintenance (30%)
  • Process incoming software exception requests, validating business justification against approval criteria
  • Maintain the allowlist as new, approved software and vendor updates are identified
  • Monitor blocked-install attempts to identify gaps, over-broad restrictions, or emerging needs
  • Maintain a knowledge base of allowlist decisions and precedent to support consistent handling of future requests
• Team Operations and Continuous Improvement (20%)
  • Participate in team routines (planning, standups, retros) and contribute to process improvements
  • Build and maintain documentation, checklists, and runbooks for allowlist policy and exception handling
  • Conduct periodic audits/spot checks of allowlist adherence and exception documentation
  • Continuously build endpoint security expertise through hands-on policy work and cross-team collaboration

About you, you have:

• 2 to 4 years of experience in cybersecurity, endpoint security, IT operations, or a related technical role
• Working knowledge of endpoint management and application control concepts
• Hands-on experience processing exceptions or access requests against defined criteria, with attention to detail and comfort working with structured processes (tickets, checklists, exception workflows)
• Ability to communicate clearly with end users and business stakeholders about software approvals and restrictions
• Strong organizational and documentation skills, with the discipline to keep records accurate and audit-ready
• Ability and enthusiasm to learn new security tools and technologies as required
• Authorization to work in the United States.

Nice to have:

• 1+ years of software or scripting experience (Python, PowerShell, or similar) to support automation of allowlist management or reporting
• Experience with endpoint management or application control platforms (e.g., Intune, Tanium, Carbon Black, AppLocker)
• Exposure to IT service management/ticketing platforms (e.g., ServiceNow)
• Relevant certifications (Security+, or an endpoint/EDR vendor certification)
• Experience working in a regulated or audited environment (e.g., SOX, HIPAA, PCI)

All roles at College Board require:

• A passion for expanding educational and career opportunities and mission-driven work
• Authorization to work in the United States for any employer
• Curiosity and enthusiasm for emerging technologies, with a