Endpoint Security Engineer

A path for every ambition.
At HUB, we believe the best work happens when people are given real space to grow and then given the autonomy to exercise it. We power progress and protect ambition: for the clients who count on us, and equally for the people who make that possible every day.
We’re creative thinkers and determined doers, guided by values that show up in how we work together: with empathy, adaptability, accountability and a genuine commitment to one another’s success. We foster bold ideas, celebrate curiosity and share what we know. Because when people grow, the work they do grows with them.
Our purpose is deeply human: to help people navigate the world on their terms, at their speed, toward their future. We hold that same commitment to the people building careers here.
Whether you’re starting out or leveling up, you’ll find the resources to evolve, the support to take on more and a team ready to back you at every stage.
Your ambition has a home here.
A path for every ambition.
At HUB, we believe the best work happens when people are given real space to grow and then given the autonomy to exercise it. We power progress and protect ambition: for the clients who count on us, and equally for the people who make that possible every day.
We’re creative thinkers and determined doers, guided by values that show up in how we work together: with empathy, adaptability, accountability and a genuine commitment to one another’s success. We foster bold ideas, celebrate curiosity and share what we know. Because when people grow, the work they do grows with them.
Our purpose is deeply human: to help people navigate the world on their terms, at their speed, toward their future. We hold that same commitment to the people building careers here.
Whether you’re starting out or leveling up, you’ll find the resources to evolve, the support to take on more and a team ready to back you at every stage.
Your ambition has a home here.
Job Description
In this role, you will own the engineering and day-to-day management of HUB’s enterprise endpoint detection and response (EDR) platform, including policy design, exclusion governance, agent lifecycle, and detection tuning. You will also assess the EDR solutions inherited through mergers and acquisitions (M&A), measuring configuration and policy parity against HUB’s standard EDR baseline to guide integration, migration, or coexistence decisions. This position is part of the Security Operations and Engineering team and works in close collaboration with Security Operations, Incident Response, Governance & Compliance, M&A integration teams, and HUB IT teams to deliver effective, measurable endpoint protection for Hub International.
Objectives of this Role
Serve as the technical owner of HUB’s enterprise EDR platform, ensuring it is deployed, healthy, and operating at required levels of coverage, service, and availability across all supported endpoints and servers.
Design, document, and maintain EDR policies, policy tiers, and group or site structures aligned to HUB security standards and operating system and workload types.
Manage the exclusion lifecycle, including intake, risk review, approval, implementation, periodic recertification, and retirement, so exclusions are justified, scoped as narrowly as possible, and auditable.
Assess the EDR solutions of acquired and to-be-acquired organizations by building and executing a repeatable, platform-neutral parity-assessment methodology covering configuration, policy settings, exclusion handling, detection and prevention coverage, and operational fit against the HUB EDR baseline.
Produce parity matrices and gap analyses that map HUB’s baseline EDR configuration and policies to the equivalent controls in each acquired entity’s EDR platform, clearly documenting where parity is full, partial, or not achievable and what remediation or compensating controls are needed.
Contribute to continuous improvement of response playbooks, detection content, and endpoint security tooling and posture.
Contribute to operations KPIs that measure endpoint coverage, agent health, detection quality, and exclusion hygiene.
Maintain current knowledge of endpoint threats, EDR/XDR technology, and adversary techniques, bringing forward ideas for modernization and improvement.
Be available for critical security incident response that requires immediate endpoint containment, investigation, or remediation.
Engage with peers regularly on endpoint security operations, project status, activities, and achievements.
Contribute to security requirements, standards, procedures, and reference architectures for endpoint protection in compliance with HUB policies and technical standards.
Daily and Monthly Responsibilities
Monitor EDR console health, agent coverage, agent version compliance, and policy drift; remediate unhealthy, outdated, or unmanaged endpoints in partnership with IT.
Review and triage endpoint alerts and threat detections, tune detections to reduce false positives, and escalate confirmed incidents to Security Operations and Incident Response.
Process exclusion requests: validate business justification, assess risk, scope by path, hash, certificate, or process as appropriate, implement approved exclusions, and maintain a central exclusion register with owners and review dates.
Perform scheduled recertification of existing exclusions and remove those that are stale, overly broad, or no longer required.
Plan, test, and stage agent upgrades, policy changes, and console configuration changes using pilot rings and documented change-management practices.
Maintain endpoint automation, integrations, and reporting using platform APIs, SIEM integrations, SOAR playbooks, and scripting.
Conduct EDR assessments for M&A targets and newly acquired entities: review tenant configuration, policies, exclusions, agent coverage, and detection settings, and compare them against the HUB EDR baseline to identify gaps and risk.
Maintain configuration and policy parity documentation for each acquired entity, including side-by-side mappings to the HUB baseline, identified gaps, compensating controls, and recommended paths (remediate in place, migrate to the HUB platform, or coexist).
Contribute to root-cause analysis for security incidents and events, and establish preventive measures, mitigations, or remediations.
Contribute to weekly and monthly posture and response operations reporting, including endpoint coverage, exclusion metrics, and platform evaluation status.
Assist in configuring new applications and infrastructure for needed endpoint and security telemetry.
Contribute to analysis and recommendations for upgrades, changes, and implementations that support the scaling of HUB’s security operations.
Support M&A due diligence and post-close integration planning by providing endpoint security findings, migration effort estimates, and risk summaries to Security leadership and integration teams.
Manage platform support cases and escalations, and track product roadmap items relevant to HUB.
Support the HUB Information Security Governance & Compliance team as needed during risk assessments, internal and external information security audits, and third-party reviews.
Skills and Qualifications
Bachelor’s degree in technology or applicable experience.
Related certifications (e.g., EDR platform administrator certifications, GSEC, GCIH, GCFE/GCFA, CISSP, AWS) preferred.
5+ years of experience in information security operations or engineering, including 3+ years administering and engineering enterprise EDR platforms; hands-on experience with a leading enterprise EDR platform required.
Demonstrated experience designing endpoint security policies and managing exclusions at enterprise scale, including balancing protection, application compatibility, and performance.
Experience assessing, integrating, or migrating between EDR/XDR products commonly found in acquired environments, including mapping configuration and policy equivalency between platforms; M&A security integration experience preferred.
Strong knowledge of Windows, macOS, and Linux internals relevant to endpoint security, including process behavior, file system and registry activity, and common attack techniques mapped to MITRE ATT&CK.
Experience with endpoint deployment and management tooling (e.g., MDM, software distribution, and configuration management platforms), and with Active Directory / MS Entra ID.
3+ years of experience with security incident response and operations, including endpoint investigation, containment, and remediation.
3+ years of experience with cloud infrastructure (AWS, GCP, Azure) and O365 services and technology.
2+ years of experience defining, refining, and driving efficiency in operational processes.
Experience with SIEM and SOAR technologies, and with KQL, SPL, or other query languages, including EDR threat-hunting query languages.
Experience with PowerShell, Python, and shell scripting, and with REST APIs for automation and reporting.
Working knowledge of TCP/IP, DNS, and netwo

Skills
Python, REST API, Linux, AWS, Azure, GCP, Due Diligence, Documentation