Senior Endpoint Security Engineer — EDR, Policy & Platform

Cubist (Point72); New York (NY); On-site; USD 170,000 - 250,000; Full time

Benefits offered by this job

Fully‑paid health care benefits

Generous parental and family leave

Volunteer opportunities

Support for employee‑led affinityGroup

Mental and physical wellness programs

Tuition assistance

A 401(k) savings program with an-emloy

Job summary

Point72 is seeking an Endpoint Security Engineer to own protective controls across workstations, servers, and virtual desktops, ensuring a measurable and resilient security posture. You will deploy CrowdStrike and Defender, design baseline policies, enforce CIS benchmarks, and remediate drift.

You’ll collaborate with security operations, infrastructure, and desktop engineering to tune detections, close gaps, and deliver sprint commitments.

Qualifications

• 5+ years of hands-on experience in endpoint security engineering within a production enterprise environment.
• Deep experience administering endpoint detection and response platforms, such as CrowdStrike Falcon, including sensor deployment across Windows, macOS, and Linux, prevention policy design, host groups, exclusions, response actions, and workflow automation
• Experience using security platform APIs, such as the CrowdStrike API, for endpoint security automation, reporting, and control-state validation
• Experience administering endpoint protection platforms, such as Microsoft Defender for Endpoint, through endpoint management security baselines and policies, including antivirus, attack surface reduction, tamper protection, and vulnerability management
• Experience operating a native endpoint protection platform alongside a third-party endpoint detection and response platform, including coexistence and passive mode configuration
• Working knowledge of endpoint security portals, such as Microsoft Defender, including advanced hunting with KQL for investigation, validation, and reporting
• Experience deploying and operating enterprise browser security controls, including policy design, extension governance, download and upload controls, and browser-layer data protection
• Experience with endpoint management tools, such as Microsoft Intune, Jamf, and Group Policy, as well as CIS Benchmarks, application control, device control, and audit-to-enforcement rollout of endpoint policies
• Experience supporting virtual desktop or thin client environments, scripting in PowerShell, Python, or Bash, and delivering sprint backlog items through verified completion
• Commitment to the highest ethical standards

Responsibilities

• Administer endpoint detection and response platforms across the endpoint estate, including sensor deployment, prevention policies, host grouping, exclusions, custom indicators of attack, and response actions
• Maintain sensor coverage across Windows, macOS, Linux, and virtual desktop environments by reconciling telemetry against asset inventory and closing coverage gaps
• Manage endpoint protection and Windows security controls, including antivirus policy, attack surface reduction, tamper protection, vulnerability management, and coexistence settings
• Govern the enterprise browser as an endpoint control surface, including policy enforcement, extension governance, data protection controls, and isolation for higher‑risk destinations
• Implement hardening baselines aligned to CIS Benchmarks through endpoint management platforms, with control‑level evaluation, remediation, and compliance evidence
• Engineer application control, device control, and host firewall policies from audit mode through measured enforcement across diverse endpoint populations
• Detect and remediate configuration drift by verifying sensor status, policy assignment, baseline compliance, and other control‑state telemetry
• Manage endpoint security exceptions with documented justification, accountable ownership, expiry dates, and ongoing review to minimize persistent risk
• Lead sensor and platform lifecycle management, including release evaluation, staged rollout planning, production deployment, and rollback readiness
• Partner with security operations, infrastructure, and desktop engineering teams to tune detections, improve response actions, and deliver sprint commitments through verified control state

Skills

Endpoint security engineering

CrowdStrike Falcon

Defender for Endpoint

CrowdStrike API

PowerShell

Python

Bash

Intune

Jamf

Group Policy

CIS Benchmarks

Tools

Microsoft Defender for Endpoint

Microsoft Defender

Job description

Point72 is seeking an Endpoint Security Engineer to own protective controls across workstations, servers, and virtual desktops, ensuring a measurable and resilient security posture. You will deploy CrowdStrike and Defender, design baseline policies, enforce CIS benchmarks, and remediate drift.

You’ll collaborate with security operations, infrastructure, and desktop engineering to tune detections, close gaps, and deliver sprint commitments.