Senior Endpoint Security Specialist - Global Security Organization

TikTok; New York (NY); On-site; USD 112,000 - 162,000; Full time

Job summary

TikTok's Global Security Organization seeks a security validation engineer to define enterprise controls and execute validation across servers, endpoints, email systems, IoT, and physical infrastructure. You will contribute to offense‑inspired assessments and build automated validation pipelines with IaC.

You will collaborate with cross‑functional teams to strengthen security posture, develop detection platforms, and integrate with SIEM/EDR while staying aligned to MITRE ATT&CK, NIST, and CIS

Qualifications

• Deep hands-on server, Kubernetes, and enterprise endpoint tech experience.
• ,

Responsibilities

• Build automated validation workflows using IaC and automation frameworks across servers, endpoints, email and IoT.
• Conduct STRIDE threat modeling and secure design libraries.
• Design fault-tolerant data pipelines (Flink/Spark, Kafka) and data lakes (ClickHouse) for telemetry.
• Lead full-stack development of internal endpoint security tools and validation platforms.
• Develop and harden detection platforms with Sigma/YARA and CI/CD to SIEM/EDR.
• Research MITRE ATT&CK TTPs and align security controls to NIST/CIS frameworks.
• Build low-code validation playbooks and microservices with integrations.

Skills

Linux

Windows

Kubernetes

macOS

Adversary Simulation

BAS (Breach-and-Attack Simulation)

MITRE ATT&CK

Threat Intelligence

Python

Go

Bash

C/C++

EDR evasion

Post-exploitation

Education

Master's degree in Computer Science or Information Security

Certifications: OSCP, CISSP, CCSP, GPEN

Tools

Ansible

Terraform

Jenkins

Chef

Puppet

Open Policy Agent

AttackIQ

SafeBreach

Cymulate

Job description

Responsibilities

The mission of TikTok's Global Security Organization is to build and earn trust by reducing risk and securing our businesses and products. Also known as 'GSO', this team is the foundation of our efforts to keep TikTok safe, secure, and operating at scale for over 1 billion people around the world. We work to ensure that the TikTok platform is safe and secure, that our users' experience and their data remains safe from external or internal threats, and that we comply with global regulations wherever TikTok operates.

Trust is one of TikTok's biggest initiatives, and security is integral to our success. In whatever ways users interact with us — whether they're watching videos on their For You page, interacting with a Live video, or buying products on TikTok Shop — GSO protects their data and privacy, so they can have a secure and trustworthy experience.

SecOps Validation Team (STOV) is responsible for the tools and technologies that support the TikTok infrastructure. STOV oversees technical validation, security operations, and drives engineering enhancements, including the deployment, configuration, and maintenance of security technologies across various domains.

This role will define enterprise security technical controls and implement validation mechanisms within TikTok environments to ensure effectiveness and compliance. It will also include offensive security activities to assess the strength of existing response measures. By working with cross-functional teams, the role will establish a measurable and repeatable process to enhance the security posture of the organization continuously.

Responsibilities

• Build automated, repeatable validation workflows using infrastructure-as-code and automation frameworks to continuously validate technical control efficacy across servers (Linux/Windows), endpoints (macOS/Windows), email systems, IoT devices, and physical infrastructure.
• Conduct STRIDE-based threat modeling on new services/infrastructure, building secure design libraries (cryptography, input validation) to enforce patterns and prevent vulnerabilities. Plan and execute assessments to test host-based detection/prevention controls under realistic attack scenarios, including EDR evasion, defense-bypass methods, and post-exploitation tradecraft.
• Design and implement fault‑tolerant, real-time data ingestion pipelines (Apache Flink/Spark Streaming, Kafka) and columnar data lakes (ClickHouse) to process petabytes of global endpoint security telemetry (HIDS, EDR, NDR, audit logs, IDS/IPS).
• Build technical roadmaps and lead full-stack development of internal endpoint security tools, including technical validation platforms, scanners, secrets management integrations, and IAM policy engines - from gRPC/Protobuf API design to Kubernetes deployment with Istio service mesh.
• Develop and harden core detection engineering platforms, enabling Sigma/YARA-L rule codification, automated backtesting against historical data, and CI/CD deployment to SIEM (Splunk ES, Chronicle) and EDR endpoints.
• Research emerging MITRE ATT&CK TTPs, prototype behavioral analytics and ML-driven anomaly detection models to identify stealthy adversaries evading traditional signature‑based defenses, and establish measurable technical security controls aligned to NIST, CIS, and MITRE ATT&CK frameworks for enterprise environments spanning servers, endpoints, email, IoT, and physical infrastructure.
• Build low‑code/no‑code validation playbooks and microservices to automate technical validation workflows, integrating with CMDBs, ITSM tools, and infrastructure APIs for issue remediation.

Qualifications

Minimum Qualifications:

• Platform & Infrastructure Expertise: Deep hands‑on experience with server (Linux, Windows), Kubernetes, and enterprise endpoint (macOS, Windows) technologies, with a track record of balancing security posture against operational and user‑experience requirements.
• Adversary Simulation Experience: Proven experience simulating advanced threat actor behavior in live, production‑scale environments using Breach-and‑Attack Simulation (BAS) frameworks and tooling.
• Threat Intelligence: Deep working knowledge of attacker Tactics, Techniques, and Procedures (TTPs) mapped to the MITRE ATT&CK framework, with experience translating threat intelligence into actionable detection rules.
• Engineering & Development: Proficiency in at least one programming or scripting language (Python, Go, Bash, or C/C++) with strong debugging and automation skills.
• Offensive Security: Strong understanding of EDR evasion techniques, defense‑by‑pass methods, and post‑exploitation tradecraft.

Preferred Qualifications

• Automation & Tooling: Hands‑on experience building security automation pipelines using infrastructure-as-code and CI/CD tooling (e.g., Ansible, Terraform, Jenkins, Chef, Puppet) and test‑automation frameworks.
• Policy & Validation: Familiarity with policy‑as‑code platforms (e.g., Open Policy Agent) or continuous security control validation solutions (e.g., AttackIQ, SafeBreach, Cymulate).
• Purple Team Operations: Experience with purple team operations, including collaborative detection validation with blue teams, tuning detection logic, and measuring coverage against ATT&CK Navigator heatmaps.
• Cross-Domain Knowledge: Working knowledge spanning multiple security domains beyond host/endpoint - including application security (SAST/DAST), cloud security (CSPM, CWPP), network security, and data protection.
• Product Development: Background in product development or engineering of enterprise security tooling (e.g., DLP engines, EDR agents, centralized logging/SIEM platforms).
• Environment & Credentials: Experience operating in large‑scale, globally distributed enterprises or high‑velocity engineering‑driven organizations. Master's degree in Computer Science, Information Security, or a related technical discipline; or relevant certifications such as OSCP, CRTO, GPEN, CISSP, or CCSP.

About TikTok

TikTok is the leading destination for short‑form mobile video. At TikTok, our mission is to inspire creativity and bring joy. TikTok's global headquarters are in Los Angeles and Singapore, and we also have offices in New York City, London, Dublin, Paris, Berlin, Dubai, Jakarta, Seoul, and Tokyo.

Why Join Us

Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy - a mission we work towards every day.

We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.

Diversity & Inclusion

TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.

TikTok Accommodation

TikTok is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/RA-request

Job Information

【For Pay Transparency】Compensation Description (Annually)

The base salary range for this position in the selected city is $111600 - $162000 annually.

Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.

Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short‑term and long‑term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).

The Company reserves the right to modify or change these benefits programs at any time, with or without notice.

For Los Angeles County (unincorporated) Candidates:

1. Interacting and occasionally having unsupervised contact with internal/external clients and/or colleagues;
2. Appropriately handling and managing confidential information including proprietary and trade secret information and access to information technology systems;
3. Exercising sound judgment.