[Remote] Endpoint Security Engineer
Note: The job is a remote job and is open to candidates in USA. Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. The Endpoint Security Engineer will design, deploy, and operationalize EDR/XDR capabilities across large-scale hybrid and multi-cloud environments, support advanced investigations, and automate endpoint security operations.
Responsibilities
- Engineer, deploy, and maintain Next-Gen Antivirus (NGAV) and EDR/XDR agents across hundreds of thousands of heterogeneous endpoints
- Implement active behavioral protections against zero-day malware, living-off-the-land binaries, fileless execution, and credential dumping
- Serve as primary technical partner to application owners and business units, establishing baseline behavior profiles to minimize false positives and operational disruption
- Manage allowlisting, exception workflows, and phased ring deployments (canary/pilot/production)
- Act as endpoint security escalation lead for SOC analysts and IT administrators during high-severity events
- Perform advanced host forensics, process-tree reconstruction, memory analysis, and script-based live remediation
- Extend endpoint security standards across private data center virtualization (VMware/Nutanix) and multi-cloud infrastructure
- Continuously validate control efficacy using automated attack simulation (BAS) tools and Purple Team exercises
- Track and report on agent health, tamper-resistance, telemetry integrity, and coverage metrics
Skills
- 7+ years of progressive experience in technical cybersecurity engineering or infrastructure security roles
- 3–5 years directly engineering and administering enterprise-grade EDR/XDR platforms across 50,000+ endpoints in a distributed hybrid environment
- Expert-level proficiency administering EDR/XDR platforms across Windows, macOS, Linux, and container runtime environments
- Deep understanding of behavioral IOAs, Sysmon telemetry, and detection authoring (SQL, KQL, Splunk SPL, or YARA)
- Strong scripting ability in PowerShell, Python, or Bash for fleet-wide remediation and automation
- Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or equivalent practical experience
- U.S. Citizenship or Permanent Residency; ability to work within the continental United States
- Candidates with previous federal contracting experience are preferred
- GIAC Certified Enterprise Defender (GCED), GIAC Certified Incident Handler (GCIH), or GCFA
- CISSP
- Vendor credentials such as CrowdStrike Certified Falcon Administrator/Hunter or Microsoft SC-200
- Prior experience supporting active SOC investigations in large-scale enterprise environments
- Fluency applying AI/ML tooling (Splunk, Databricks, Elastic) to streamline security operations
Benefits
- Medical — Multiple POS health plan options including an HSA-compatible plan
- Dental — PPO coverage for preventive, basic, and major services
- Vision — Annual exam, frames, lenses, and contact lens allowance
- 401(k) — Employer match up to 5% of eligible compensation
- Long-Term Disability — 100% employer-paid coverage at 50% of pre-disability earnings
- Life Insurance & AD&D — 100% employer-paid coverage valued at $10,000 each
- PTO — 15–25 days annually based on tenure
- Paid Federal Holidays — All 11 federal holidays observed
Company Overview