Note: The job is a remote job and is open to candidates in USA. Legato Security is hiring a Security Engineer to own endpoint detection and response for its managed security customers. The role deploys, tunes, and operates endpoint security platforms and manages SIEM pipelines and integrations in collaboration with internal teams and customers.
Responsibilities
- Administer multi-tenant consoles (Falcon Flight Control parent/child CIDs, Defender multi-tenant management, SentinelOne sites and groups), including RBAC, policy inheritance, and sensor update rings
- Tune prevention and detection policies to cut noise without opening gaps
- Track sensor health and coverage: Unmanaged hosts, reduced-functionality mode, stale sensors, and version drift
- Administer EDR-to-SIEM pipelines into Sumo Logic Cloud SIEM, Microsoft Sentinel, and Stellar Cyber
- Build and maintain API integrations between EDR platforms, SOAR, ticketing, and threat intel
- Plan and run EDR deployments and migrations for new customers: Sensor rollout through Intune, SCCM, GPO, or Jamf; policy design; exclusions
Skills
- 2+ years deploying or administering an enterprise EDR (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or comparable) in production, plus 2+ years of systems administration
- At least one EDR deployment or migration you ran end to end: Rollout, policy, exclusions, and handoff to operations
- Experience with Windows internals and macOS/Linux administration to troubleshoot sensor problems, such as service failures, system extensions, eBPF, AV conflicts, proxies, and TLS inspection
- Active experience with SIEM work, e.g. onboarding of log sources, event parsing, field extractions, and query creation across a variety of tools
- PowerShell plus Python or Go, including scripting API access and endpoint deployment scripts
- Working knowledge of MITRE ATT&CK and how attacker techniques show up in endpoint telemetry
- Excellent writing skills for creating runbooks, incident summaries, and configuration guides
- 4+ years focused on CrowdStrike Falcon or SentinelOne, or production experience with more than one of the following EDR products: Falcon, Defender for Endpoint, and SentinelOne
- MSSP or other multi-tenant operations experience
- Sysmon deployment and configuration tuning, for customers without a commercial EDR or as extra visibility alongside one
- Experience supporting federal or public-sector environments: NIST SP 800-53 controls, the Risk Management Framework, FedRAMP, and federal security authorization and assessment processes
Benefits
- Opportunity for advancement based on performance
- Competitive medical and dental benefits for employee and family members
- Short-term disability
- Basic life insurance
- Children’s orthodontia
- Additional voluntary benefits available
- 401K match
- Flexible Paid Time Off policy
- Professional Development opportunities specific to role
- Remote work for personnel anywhere within the U.S.
Company Overview