Information Security Architect – Endpoint Security / EDR-XDR

Cadence Systems•San Jose, CA

1d•$168,000 - $312,000

About The Position

Cadence is seeking an experienced Information Security Architect focused on endpoint security to define, architect, and evolve the organization’s enterprise endpoint security strategy, particularly for EDR, XDR, and modern endpoint protection technologies. The role establishes architectural vision, security standards, technical roadmaps, and governance across Windows, Linux, and macOS environments. It translates business and security requirements into scalable architectures aligned with the organization’s cybersecurity strategy, risk appetite, regulatory obligations, and threat landscape, combining strategic guidance with technical expertise to evaluate solutions, validate designs, troubleshoot complex issues, and guide engineering teams. The architect serves as the senior technical authority for enterprise EDR/XDR, defining platform architecture, deployment models, policies, control frameworks, integrations, and governance. The role partners with Security Operations, Incident Response, engineering, and enterprise architecture teams to improve detection, investigation, response, and endpoint security integration. It also supports governance, risk and compliance, audits, enterprise transformations, and mergers and acquisitions, while providing technical leadership, mentorship, and guidance to engineers and stakeholders.

Requirements

At least 8 years of experience in information security, cybersecurity engineering, security architecture, endpoint security, security operations, or a related field.
Demonstrated experience designing and architecting enterprise endpoint security solutions at scale.
Deep hands-on and architectural experience with EDR and/or XDR technologies, including governing environments across thousands of endpoints.
Strong understanding of endpoint security architecture across Windows, Linux, and macOS.
Strong understanding of endpoint attack techniques, malware behavior, persistence, privilege escalation, lateral movement, command execution, and common attacker techniques.
Strong experience with EDR/XDR detection, threat hunting, incident response, remediation, and endpoint isolation.
Experience developing enterprise security standards, architecture patterns, technical baselines, and security controls.
Strong understanding of enterprise networking fundamentals, including TCP/IP, DNS, HTTP/HTTPS, TLS, proxies, firewalls, and common security protocols.
Experience designing integrations between EDR/XDR platforms and SIEM, SOAR, ITSM, vulnerability management, identity, and other security technologies.
Strong understanding of security architecture principles, defense-in-depth, Zero Trust, least privilege, and risk-based security design.
Experience with scripting and automation using PowerShell, Python, Bash, or similar technologies.
Strong analytical, architecture, documentation, and problem-solving skills.
Excellent communication skills and ability to influence technical teams and senior stakeholders.
Ability to work effectively in a large, complex enterprise with multiple technology and infrastructure organizations.

Nice To Haves

Experience with multiple leading EDR/XDR platforms and technologies.
Experience evaluating, selecting, and migrating between EDR/XDR platforms.
Experience integrating EDR/XDR with SIEM, SOAR, MDR, ITSM, identity, vulnerability management, and cloud security platforms.
Experience with Microsoft security technologies, including Microsoft Defender, Entra ID, Intune, Microsoft 365 Defender, and related services.
Experience with SentinelOne, CrowdStrike, Microsoft Defender for Endpoint, Palo Alto Cortex XDR, or similar enterprise platforms.
Experience architecting security solutions in Azure and/or AWS.
Strong knowledge of MITRE ATT&CK and adversary techniques.
Experience with vulnerability management platforms such as Tenable.
Experience with CIS benchmarks, endpoint hardening, security baselines, and compliance frameworks.
Experience with enterprise endpoint management platforms such as SCCM/MECM, Intune, Jamf, Ansible, or similar technologies.
Experience with Zero Trust architecture and endpoint security modernization.
Experience leading endpoint security architecture assessments and technology evaluations.
Experience supporting mergers, acquisitions, divestitures, and enterprise technology integrations.
Security architecture certifications such as CISSP, SABSA, CCSP, or GIAC.

Responsibilities

Define and own enterprise endpoint security architecture and technical strategy across Windows, Linux, and macOS.
Develop and maintain roadmaps for EDR, XDR, endpoint protection, detection, threat prevention, and response capabilities.
Establish endpoint security architecture principles, standards, reference architectures, technology patterns, and control requirements.
Architect and govern scalable EDR/XDR solutions for large, distributed, heterogeneous environments, including environments with thousands of endpoints.
Define requirements for endpoint protection, telemetry, prevention, detection, isolation, remediation, threat hunting, agent health, and centralized management.
Assess current endpoint security capabilities and develop target-state architectures and transformation roadmaps.
Evaluate and recommend EDR/XDR technologies using security effectiveness, scalability, operational impact, integration capabilities, and total cost of ownership.
Define integration architectures for EDR/XDR and endpoint security platforms with SIEM, SOAR, SOC, ITSM, identity, vulnerability management, cloud security, network security, and other platforms.
Establish architecture patterns for onboarding business units, platforms, cloud workloads, and acquired environments.
Ensure endpoint security architecture supports Zero Trust and defense-in-depth strategies.
Define technology-agnostic EDR/XDR requirements and evaluation criteria.
Set EDR/XDR architecture, deployment, organizational, policy, configuration, exclusion, application-control, segmentation, and governance standards.
Establish standards for agent lifecycle management, upgrades, configuration changes, and platform enhancements.
Guide endpoint telemetry, behavioral detection, threat hunting, automated response, remediation, isolation, rollback, and forensic investigation capabilities.
Provide architectural guidance for managed detection and response capabilities where applicable.
Review and approve significant EDR/XDR architecture, configuration, and policy changes from a security-risk perspective.
Define endpoint detection and response architecture informed by threat intelligence and adversary behavior, including alignment with MITRE ATT&CK.
Set requirements for telemetry, process monitoring, command-line visibility, network activity, behavioral detection, and endpoint threat intelligence.
Partner with Security Operations and Incident Response teams to improve detection and response; provide guidance for threat hunting and advanced investigations.
Analyze attack techniques, malware trends, persistence, lateral movement, and endpoint attack vectors; define controls to detect and mitigate them.
Define requirements for automated and analyst-driven endpoint containment and remediation; participate in complex investigations and provide guidance during major incidents.
Conduct post-incident architecture reviews and recommend endpoint security improvements.
Define enterprise endpoint security baselines, hardened configurations, technical standards, and reference architectures for Windows, Linux, and macOS.
Set security requirements for endpoint management technologies and partner with endpoint engineering teams to incorporate controls into build and deployment processes.
Guide vulnerability management, endpoint hardening, application control, attack-surface reduction, provisioning, configuration, lifecycle management, and decommissioning.
Establish standards for endpoint security exceptions, exclusions, risk acceptance, and compensating controls.
Ensure endpoint designs support CIS benchmarks, organizational standards, audit requirements, and regulatory obligations; review proposed technology and infrastructure changes for endpoint security implications.
Partner with enterprise and solution architects to integrate endpoint security into broader enterprise security architecture.
Develop security architecture requirements, diagrams, data-flow diagrams, reference designs, and technical standards for endpoint and related platform integrations.
Evaluate security implications of new technologies, applications, infrastructure platforms, and cloud services.
Ensure endpoint telemetry and controls integrate with enterprise monitoring and analytics; define automation and orchestration requirements and identify workflow optimization opportunities with SOC and engineering teams.
Establish endpoint security architecture governance and participate in architecture review boards and technology governance processes.
Assess endpoint security risks, recommend controls and mitigating architectures, and provide risk-based recommendations on exceptions.
Support internal and external audits with architecture, standards, and control documentation; ensure designs align with applicable regulatory, compliance, and organizational requirements.
Define endpoint security architecture metrics and KPIs, and develop executive reporting on posture, maturity, and strategic initiatives.
Lead or provide architecture support for mergers, acquisitions, divestitures, and major technology transformations; assess acquired environments and develop integration and migration strategies.
Develop transition roadmaps to standardize endpoint security across newly integrated organizations and identify gaps, risks, technical debt, and integration challenges.
Provide technical leadership and architecture direction to security engineers and infrastructure teams; collaborate across SOC, Incident Response, Network Security, Cloud Security, Identity, Infrastructure, IT, and Application teams.
Translate security requirements into practical, scalable architectures; mentor security professionals and engineers.
Lead vendor and service-provider technical discussions, architecture reviews, proof-of-concepts, evaluations, and design workshops.
Communicate technical risks and architecture decisions to technical teams and executive audiences.