Lead Engineer – Endpoint Security

Purpose As the Endpoint Security Engineer, you are accountable for defining endpoint hardening standards and engineering baseline security controls across all Windows, macOS, and Linux device estates. Operating as a hands-on technical lead, you will drive endpoint risk reduction across the enterprise.

Responsibilities

• By configuring advanced EDR/XDR controls, managing device compliance frameworks, and supporting incident response teams, you will ensure end-user devices are continuously defended against modern compromise techniques.
• In this role, you will lead and manage the following domains: Endpoint Hardening & Baselines: Defining, implementing, and enforcing security baselines across Windows, macOS, and Linux fleets.
• Managing and tuning Microsoft Defender endpoints and security capabilities.
• Designing compliance policies that enforce endpoint health prior to granting corporate resource access.
• Leading targeted initiatives to mitigate system vulnerabilities, OS flaws, and configuration drift.
• Conducting technical endpoint security reviews and assisting incident response teams during major investigations.
• Expertise & Architecture Deep understanding of OS internal security structures (Windows Defender, macOS Security Frameworks, Linux PAM/AppArmor/SELinux) and local attack mitigation controls.
• Tooling & Technical Proficiency Proficiency in Microsoft Defender for Endpoint, Intune, JAMF, Microsoft Security Baselines, CIS Benchmarks, and endpoint management systems.
• Risk Management & Prioritisation Ability to prioritize OS-level misconfigurations and endpoint vulnerabilities based on active exploit availability and local device access rights.
• Governance, Process & Control Design Experience designing automated device compliance policies, device health attestation checks, and local privilege management controls.
• Service Delivery & Operational Management Proven ability to manage endpoint security agent coverage, maintain health telemetry across global device estates, and minimize agent conflicts.
• Data Analysis, Reporting & Insight Skilled in analyzing endpoint telemetry, KQL querying, and generating clear health dashboards for device compliance and security posture.
• & Influence Ability to partner with workplace platform engineering teams to push security updates and baseline policy changes without disrupting end-user productivity.
• Threat Intelligence Integration Ability to translate threat intelligence indicators (IoCs) and adversary techniques (MITRE ATT&CK) into tailored endpoint detection and block rules.
• Leadership & Collaboration Proven ability to lead technical endpoint security workstreams, provide clear remediation directions, and mentor junior operational staff.
• & Automation Experience driving security automation through script-based remediation (PowerShell, Bash, Python) and unified endpoint management integrations.
• Success Measures Endpoint Hardening & Security Baselines Accountability: Architect, deploy, and maintain standardized security baselines for all Windows, macOS, and Linux endpoints.
• Greater than 98% compliance rate with established OS security baselines across the entire enterprise estate; 100% of managed devices bound by strict compliance and attestation requirements.
• >99% agent deployment health and active reporting across all connected devices; Dynamic detection policy coverage mapped directly against top MITRE ATT&CK techniques.
• Drive endpoint risk reduction programs aimed at mitigating configuration flaws, unpatched software, and high-risk local permissions.

Requirements

• & Qualifications - Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent practical experience). - A minimum of 5–7 years' technical experience in endpoint security engineering, OS hardening, and endpoint management at scale. - Deep engineering knowledge of multi-OS security architectures (Windows, macOS, Linux) and cross-platform EDR deployment. - Relevant certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), GIAC Endpoint Asset Protection (GCED), or CISSP are highly desirable.

Preferred

• Engineer Microsoft Defender capabilities, optimize detection engine rules, and ensure full agent health across all OS platforms.

Success Measures

Measurable structural reduction in high and critical endpoint security posture gaps; MTTR for critical endpoint configuration drift kept within defined SLA targets. Dyson is an equal opportunity employer. We know that great minds don’t think alike, and it takes all kinds of minds to make our technology so unique. We welcome applications from all backgrounds and employment decisions are made without regard to race, colour, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other any other dimension of diversity.