Security Engineer II (Endpoint Security)

College Board•Remote - Virginia, VA

1d•$116,000 - $125,000•Remote

About The Position

As a Security Engineer II, Endpoint Security, you will own the ongoing engineering of College Board’s application allowlist, ensuring only approved software runs on managed endpoints. You will maintain and extend allowlist coverage as software, vendors, and business needs evolve; define and adjust policy as new device groups come online; and process exception requests. Application allowlisting is a continuous control that must remain effective as the environment changes, and this role keeps enforcement current, accurate, and low-friction for the business. The role partners closely with IT, application owners, and business-unit stakeholders to capture software needs and reflect them in the allowlist. The position is part of Enterprise Security Engineering (ESE), which builds and operates foundational security platforms and controls that protect College Board’s enterprise environment. ESE covers security observability, endpoint security, network and edge security, data security, security review management, and AI security. It is both an engineering team and a standards-setting function, designing, building, and operating controls and owning enterprise security standards that operationalize information security policies. The team works across security, Technology, and other organizational divisions to deliver measurable security outcomes through automation, disciplined platform operations, and continuous improvement. This is a full-time, fully remote role. Candidates who live near College Board offices may choose a hybrid arrangement, working in the office Tuesday and Wednesday. All employees are required to travel occasionally for in-person business purposes.

Requirements

2 to 4 years of experience in cybersecurity, endpoint security, IT operations, or a related technical role.
Working knowledge of endpoint management and application control concepts.
Hands-on experience processing exceptions or access requests against defined criteria, with attention to detail and comfort working with structured processes such as tickets, checklists, and exception workflows.
Ability to communicate clearly with end users and business stakeholders about software approvals and restrictions.
Strong organizational and documentation skills, with the discipline to keep records accurate and audit-ready.
Ability and enthusiasm to learn new security tools and technologies as required.
Authorization to work in the United States.
Passion for expanding educational and career opportunities and mission-driven work.
Curiosity and enthusiasm for emerging technologies, willingness to experiment with and adopt new solutions, and comfort independently and proactively learning and applying new digital tools.
Clear and concise written and verbal communication skills.
A learner’s mindset and commitment to growth, including welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input.
Drive for impact and excellence, including solving complex problems, making data-informed decisions, prioritizing effectively, and improving through learning, user input, and external benchmarking.
Collaborative and empathetic approach to working across differences, fostering trust, and contributing to shared success.

Nice To Haves

1+ years of software or scripting experience (Python, PowerShell, or similar) to support automation of allowlist management or reporting.
Experience with endpoint management or application control platforms such as Intune, Tanium, Carbon Black, or AppLocker.
Exposure to IT service management or ticketing platforms such as ServiceNow.
Relevant certifications such as Security+ or an endpoint/EDR vendor certification.
Experience working in a regulated or audited environment such as SOX, HIPAA, or PCI.

Responsibilities

Maintain and extend the application allowlist baseline as software, vendors, and business needs change.
Define and adjust allowlist enforcement tiers and rollout sequencing as new device groups or business units come online.
Test and validate allowlist policy changes before enforcement to minimize business disruption.
Track and report device coverage, blocked installs, and open risks.
Process incoming software exception requests, validating business justification against approval criteria.
Maintain the allowlist as new approved software and vendor updates are identified.
Monitor blocked-install attempts to identify gaps, over-broad restrictions, or emerging needs.
Maintain a knowledge base of allowlist decisions and precedent to support consistent handling of future requests.
Participate in team routines, including planning, standups, and retrospectives, and contribute to process improvements.
Build and maintain documentation, checklists, and runbooks for allowlist policy and exception handling.
Conduct periodic audits or spot checks of allowlist adherence and exception documentation.
Build endpoint security expertise through hands-on policy work and cross-team collaboration.