Senior Endpoint Security Engineer — Remote, High-Impact

Socket.dev; Washington (District of Columbia); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical — Health plan options

Dental — PPO coverage

Vision — annual exam & allowances

401(k) — employer match

Long-Term Disability — employer-paid

Life Insurance & AD&D — employer-paid

PTO — 15-25 days

Paid Federal Holidays — 11 holidays

Job summary

Dragonfli Group in Washington, DC is seeking an experienced Endpoint Security Engineer to design, deploy, and operationalize EDR/XDR capabilities protecting a large private and federal-facing fleet across on-prem, cloud, and hybrid environments.

You will partner with application owners to tune policies, drive automation via infrastructure-as-code, and provide tier-3/4 escalation support during active investigations within a multi-year federal contract.

Qualifications

• 7+ years in technical cybersecurity engineering or infrastructure security roles.
• 3–5 years engineering and administering EDR/XDR platforms across 50,000+ endpoints.
• Expert-level proficiency across Windows, macOS, Linux and container runtimes.
• Deep understanding of behavioral IOAs, Sysmon telemetry, and detection authoring (SQL, KQL, SPL, YARA).
• Strong scripting ability in PowerShell, Python, or Bash for fleet-wide automation.
• Bachelor’s degree and U.S. citizenship or PR; ability to work within the continental U.S.

Responsibilities

• Engineer, deploy, and maintain NGAV and EDR/XDR agents across hundreds of thousands of endpoints.
• Implement active protections against zero-day malware, LOtL binaries, fileless execution, credential dumping.
• Partner with application owners to establish baseline behavior profiles to minimize false positives.
• Manage allowlisting, exception workflows, and phased ring deployments (canary/pilot/production).
• Act as endpoint security escalation lead for SOC analysts during high-severity events.
• Perform advanced host forensics, memory analysis, and live remediation scripting.
• Extend endpoint security standards across private data centers and multi-cloud infra.
• Validate control efficacy using BAS tools and Purple Team exercises.
• Track agent health, tamper-resistance, telemetry integrity, and coverage metrics.

Skills

EDR/XDR engineering

Behavioral threat hunting

Windows/Linux kernel internals

Multi-cloud security

Automation scripting

Host forensics & memory analysis

Attack simulation / BAS

Policy & baseline development

Education

Bachelor's degree in CS/Cybersecurity/IS or equivalent

Tools

CrowdStrike Falcon

Microsoft Defender for Endpoint

SentinelOne

Splunk

Databricks

Elastic

VMware/Nutanix

Job description

Dragonfli Group in Washington, DC is seeking an experienced Endpoint Security Engineer to design, deploy, and operationalize EDR/XDR capabilities protecting a large private and federal-facing fleet across on-prem, cloud, and hybrid environments.

You will partner with application owners to tune policies, drive automation via infrastructure-as-code, and provide tier-3/4 escalation support during active investigations within a multi-year federal contract.