Lead Endpoint Cybersecurity Engineer

TIAA • Frisco, TX

1d • $124,000 - $154,000 • Onsite

About The Position

The Lead Endpoint Cybersecurity Engineer is a senior technical engineering role responsible for designing, deploying, maintaining, testing, troubleshooting, and continually improving enterprise endpoint cybersecurity technologies. The role provides technical leadership across endpoint security platforms and supporting infrastructure, helping ensure that security applications are stable, performant, integrated, and capable of operating at enterprise scale. It extends the internal Endpoint Engineering charter and includes strategic engineering responsibilities for an enterprise deception framework and an endpoint-based AI Detection and Response (AIDR) capability intended to identify and respond to emerging AI and agentic-AI threats.

The engineer leads endpoint cybersecurity work across Windows, macOS, Linux, VDI, and server environments, as applicable. Work includes solution lifecycle management, senior-level break/fix and problem management, root-cause analysis, testing and validation, automation, operational documentation, and coordination of complex incidents with cybersecurity, infrastructure, desktop engineering, vendors, and application owners. The role tests for endpoint stability, performance, compatibility, coexistence, and safe deployment, and provides technical go/no-go recommendations before production deployment.

For the Enterprise Deception Framework, the engineer leads endpoint activities to deploy, integrate, validate, operate, and optimize the capability. This includes testing endpoint lures and failure conditions, validating telemetry integrations, supporting deployment waves, and improving operations after deployment. For AIDR, the engineer leads endpoint engineering and technical implementation activities associated with evaluating and deploying the capability.

The role also ensures endpoint implementations adhere to architecture, privacy, security, change-management, and production-safety requirements, and validates integration with EDR/XDR, SIEM, SOAR, identity, and security operational workflows. The stated education preference is a university degree; five or more years of work experience are required, with seven or more preferred. The listed physical requirement is sedentary work.

Requirements

• At least 5 years of experience with security technology proofs of concept, product evaluations, and production deployments.
• Hands-on experience engineering and supporting enterprise deception or other endpoint cybersecurity solutions.
• At least 5 years of work experience are required.
• Sedentary work physical requirement.

Nice To Haves

• Seven or more years of work experience.
• University degree preferred.
• Understanding of Zero Trust, endpoint hardening, security baselines, vulnerability management, and incident response.
• Experience conducting endpoint application performance, compatibility, stability, and regression testing.
• Technology, engineering, or equivalent professional experience.
• CISSP, GIAC, Microsoft security certifications, CrowdStrike certifications, or comparable industry certifications.
• Experience translating security architecture and risk requirements into endpoint engineering implementations.
• Experience testing multiple concurrent cybersecurity agents for performance and interoperability.
• Previous technical leadership or mentoring experience.

Responsibilities

• Serve as a technical lead for enterprise endpoint cybersecurity technologies across Windows, macOS, Linux, VDI, and server environments, as applicable.
• Design, configure, deploy, maintain, upgrade, and troubleshoot endpoint cybersecurity applications and agents.
• Provide senior-level break/fix and problem-management support, including root-cause analysis for application failures, agent health issues, policy conflicts, deployment or integration failures, and endpoint instability.
• Perform application lifecycle activities, including upgrades, configuration changes, policy tuning, regression testing, deployment validation, and rollback planning.
• Develop technical standards, runbooks, operating procedures, implementation documentation, and support documentation.
• Identify opportunities for automation using scripting, APIs, configuration-management platforms, and other engineering mechanisms.
• Troubleshoot agent installation, upgrade, communication, policy, interoperability, and stability issues.
• Coordinate complex incidents with cybersecurity, infrastructure, desktop engineering, vendors, and application owners.
• Identify conflicts between existing and proposed cybersecurity agents.
• Perform stability, coexistence, upgrade, rollback, failure-mode, and regression testing.
• Document testing findings and provide technical go/no-go recommendations before production deployment.
• Establish performance monitoring following initial deployment waves.
• Engineer endpoint components of the Enterprise Deception Framework across supported workstation and server populations.
• Perform proof-of-concept and production-readiness testing for deception capabilities.
• Validate deceptive files, credentials, registry artifacts, sessions, processes, and related endpoint lures for approved use cases.
• Test failure conditions and confirm endpoint stability when deception components are unavailable or impaired.
• Validate integration of deception telemetry with enterprise security monitoring and response systems.
• Support deployment waves and troubleshoot installation, communications, configuration, and endpoint-side operational issues for deception components.
• Develop deployment procedures, engineering standards, configuration documentation, troubleshooting guides, and operational runbooks for the Deception Framework.
• Assist with tuning and continuous improvement following production deployment.
• Ensure endpoint implementation adheres to architecture, privacy, security, change-management, and production-safety requirements.
• Validate integration with existing EDR/XDR, SIEM, SOAR, identity, and security operational workflows.
• Conduct controlled performance testing to quantify CPU, memory, and other endpoint overhead.
• Lead endpoint engineering and technical implementation activities associated with evaluating and deploying an endpoint-based AI Detection and Response capability.

Benefits

• Superior retirement program.
• Competitive health, wellness, and work-life offerings.
• Compensation package may include participation in an incentive program linked to performance, depending on the role.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed