Senior EDR & Threat Detection Engineer

Recorded Future; United States; On-site; USD 79,000 - 118,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

401K

Job summary

Recorded Future is seeking an EDR Security Engineer to join the Incident Response team. You will administer and refine EDR platforms across a diverse environment, ensuring telemetry integrity and effective detection logic.

As part of the IR function, you may occasionally support after-hours incident containment and system restoration, while documenting changes and maintaining SOPs for internal stakeholders.

Qualifications

• Minimum of 3 years of professional experience managing EDR solutions in an enterprise environment.
• Proficiency in PowerShell, Python, or Bash for automation and data querying.
• Comprehensive knowledge of Windows, macOS, and Linux internals, processes, registry/configs, and logging.

Responsibilities

• Oversee deployment, lifecycle management, and configuration of multiple enterprise EDR platforms (e.g., CrowdStrike, SentinelOne, Defender for Endpoint).
• Monitor agent health and troubleshoot to maintain service levels.
• Develop and refine detection policies to improve accuracy and reduce false positives.
• Manage security deployments across multi-cloud environments (AWS, Azure, GCP).
• Collaborate to maintain integrations between EDR consoles and SIEM/SOAR platforms.
• Assist IR during active incidents with containment and remote data collection.
• Document changes, SOPs, and configuration baselines.

Skills

EDR management

PowerShell

Python

Bash

Windows OS

macOS/Linux

Networking

Cloud security

Splunk

Tines

XSOAR

Zscaler

Threat hunting

GCFA

GCIA

Tools

CrowdStrike

SentinelOne

Defender for Endpoint

Splunk

Tines

Palo Alto XSOAR

Zscaler

Job description

Recorded Future is seeking an EDR Security Engineer to join the Incident Response team. You will administer and refine EDR platforms across a diverse environment, ensuring telemetry integrity and effective detection logic.

As part of the IR function, you may occasionally support after-hours incident containment and system restoration, while documenting changes and maintaining SOPs for internal stakeholders.