Senior EDR Engineer — Cloud + IR Detection Lead

Recorded Future, Inc.; Northern (KY); Hybrid; USD 78,000 - 118,000; Full time

Benefits offered by this job

Incentive compensation

Equity

Health insurance

401K

Job summary

Recorded Future, Inc. is seeking an EDR Security Engineer to manage multiple enterprise EDR platforms and support incident response. The role covers detection engineering, cloud workload protection, and tooling integrations across SIEM/SOAR ecosystems.

The ideal candidate brings 3+ years in enterprise EDR, scripting skills, and strong knowledge of Windows, macOS, and Linux internals, plus cloud security services. On-call after-hours may be required.

Qualifications

• 3+ years of professional experience managing EDR solutions in an enterprise environment.
• Proficiency in PowerShell, Python, or Bash for automation and data querying.
• Knowledge of Windows, macOS, and Linux internals, including processes, registry/configs, and logging.
• Understanding of TCP/IP, DNS, and proxy configurations related to agent-to-console communication.
• Familiar with AWS, Azure, or GCP security services (GuardDuty, Defender for Cloud).
• Experience with Splunk, Tines, Palo Alto XSOAR, or Zscaler as security tooling.
• Familiar with digital forensics and proactive threat hunting methodologies and tools.
• GCFA/GCIA or platform-specific admin certifications.

Responsibilities

• Oversee deployment, lifecycle, and configuration of enterprise EDR platforms (e.g., CrowdStrike, SentinelOne, Defender for Endpoint).
• Monitor agent health and troubleshoot failures across endpoints to meet service levels.
• Develop/refine detection policies and indicators; translate threat intel into endpoint rules.
• Manage security deployments across multi-cloud environments (AWS, Azure, or GCP).
• Ensure telemetry and protection for VMs and container workloads; use cloud-native services as needed.
• Collaborate with engineering to maintain integrations between EDR consoles and SIEM/SOAR platforms.
• Assist IR analysts during incidents with containment, live response scripts, and data collection.
• Document changes, SOPs, and configuration baselines; adhere to change management.

Skills

EDR administration

Incident Response

PowerShell

Python

Bash

Windows

macOS

Linux

Networking

AWS

Azure

GCP

CrowdStrike

SentinelOne

Defender for Endpoint

Splunk

Tines

Palo Alto XSOAR

Zscaler

Forensics

Threat hunting

GCFA

GCIA

Education

GCFA certification

GCIA certification

Tools

CrowdStrike

SentinelOne

Microsoft Defender for Endpoint

Job description

Recorded Future, Inc. is seeking an EDR Security Engineer to manage multiple enterprise EDR platforms and support incident response. The role covers detection engineering, cloud workload protection, and tooling integrations across SIEM/SOAR ecosystems.

The ideal candidate brings 3+ years in enterprise EDR, scripting skills, and strong knowledge of Windows, macOS, and Linux internals, plus cloud security services. On-call after-hours may be required.