Security Engineer II

Paychex•Cincinnati, OH

About The Position

Paychex is reimagining how businesses manage their workforce by bringing payroll, HR, benefits, and advisory services together into a single connected HCM platform. As Paychex and Paycor come together, we're combining innovative technology, data-driven insights, AI, and human expertise to help organizations work smarter, support their people, and achieve better business outcomes. This is an exciting time to join our team as we continue to invest in innovation, simplify client experiences, and shape the future of work. At Paychex, you'll have the opportunity to grow your career, make a meaningful impact, and be part of something bigger as One Paychex. As a Security Engineer II – Endpoint Security, you will serve as an independent assurance layer for the security posture of every corporate endpoint — laptop, server, and workstation across Mac, Windows, Linux, and Windows Server — closing the gaps that make privilege escalation and lateral movement possible. You will validate that local administrative rights, endpoint configuration, and installed software match security intent, while directly owning browser/IDE extension governance and the tuning of endpoint security agents. Reporting into the Cyber Threat Intelligence organization, you will work end-user facing issues end to end and partner closely with Desktop Engineering, Identity & Access Management, and Security Operations. An ideal candidate combines solid Enterprise Security fundamentals with practical, cross-platform endpoint engineering and system administration experience.

Requirements

2 years of experience in Information Security, Cyber Security, or Endpoint/Systems Engineering.
1 year of experience administering cross-platform endpoint environments (Windows, Windows Server, macOS, Linux).
Working knowledge of Active Directory, Group Policy Objects, and registry-level security baselining; familiarity with scripting (Python, PowerShell, Bash).
Endpoint Security
Endpoint Detection And Response
Data Loss Prevention (DLP)
Group Policy / Active Directory
Cross-Platform OS Administration
PowerShell
Python (Programming Language)

Responsibilities

Continuous Endpoint Hardening: Maintain a standing, open-ended mandate to identify and drive endpoint security improvements across the fleet — beyond any fixed checklist.
Endpoint Sensor Engineering: Administer, tune, and troubleshoot endpoint security agents (CrowdStrike Falcon, DTEX, Zscaler ZDP) across all platforms; continuously tighten CrowdStrike prevention/detection policy and investigate agent alerts, escalating true positives with context.
Application & Extension Governance: Own the browser/IDE extension review process end to end (risk-scoring, approve/deny/remove) and run recurring automated reviews of installed software to surface unauthorized, high-risk, or end-of-life applications.
Exception Management: Manage approval, tracking, and reporting of endpoint security exceptions.
Configuration Assurance & Allow-Listing: Validate Group Policy and registry-level settings against security best practices, and partner with Desktop Engineering to move the fleet to an approved application allow list.
Extended Tooling & Firmware Exposure: Assist with DSPM, inventory/assess out-of-band management tools and applications.
End-User Support & Documentation: Serve as the primary technical resource for end-user endpoint security issues, and document standards, runbooks, and best-practice guidance for partner teams.