Senior Endpoint Security Engineer

Barracuda Networks Inc.•Alpharetta, GA

55d•$110,000 - $130,000•Remote

About The Position

Barracuda is seeking a Senior Endpoint Security & IR Engineer to join its incident response team. The role leads management of the SentinelOne XDR platform, complex investigations across multiple client environments, rapid containment of active threats, and client advisory during critical security events. It combines deep technical expertise and client-facing communication in a fast-paced, multi-tenant MSSP environment, working closely with Cyber Concierge, Threat Analysts, and Automation teams to improve response capabilities and protect clients.

Requirements

Bachelor’s degree in computer science.
At least 5 years of hands-on experience in incident response, digital forensics, or security operations.
Expert knowledge and experience in SentinelOne.
GIAC certification required; examples include GCIH, GCFA, GCFE, or GNFA. Equivalent certifications considered include OSCP, eCIR, eCDFP, EnCE, SC-200, and AZ-500.
Experience with Windows, Mac, and Linux environments.
Experience investigating real-world incidents, including ransomware, business email compromise, lateral movement, and data exfiltration.
Experience working in multi-tenant environments with diverse security maturity levels.
Experience with Binalyze AIR remote acquisition, triage, timeline analysis, and artifact collection.
Experience with SentinelOne threat investigations, Deep Visibility, detection engineering, and policy configuration.
Experience with Microsoft 365/Defender, including BEC investigation, UAL analysis, Safe Links/Attachments, and Entra ID.
Experience with Databricks, including large-scale log analysis, SQL/Python notebooks, and threat hunting at scale.
Experience with workflow automation, playbook development, API integrations, and continuous monitoring.

Nice To Haves

MSSP, MDR, or consulting experience; the ability to manage multiple client engagements simultaneously is preferred.
Experience with additional EDR platforms such as CrowdStrike or Microsoft Defender for Endpoint.
Advanced knowledge of macOS and Linux forensics.
Familiarity with threat intelligence platforms such as MISP, Recorded Future, or VirusTotal Enterprise.
Experience with Velociraptor, KAPE, or Volatility for advanced forensic collection and investigations.
Prior experience in incident response teams or serving as an incident response practice subject matter expert.

Responsibilities

Lead end-to-end incident response engagements across diverse client environments, from initial triage through remediation and lessons learned.
Perform host-based forensics using Binalyze AIR for remote evidence acquisition, triage, and analysis at scale.
Design custom detection rules within SentinelOne and fine-tune protection policies.
Investigate SentinelOne alerts and threats, including Deep Visibility hunting, threat timeline reconstruction, and MITRE ATT&CK mapping.
Analyze Microsoft 365 security incidents, including business email compromise, OAuth abuse, mailbox rule manipulation, and Azure AD/Entra ID attacks.
Conduct log analysis and threat hunting in Elastic to identify indicators of compromise, lateral movement, and data exfiltration.
Use Databricks for large-scale log analytics, anomaly detection, and threat hunting across aggregated client telemetry.
Document findings in clear, executive-ready incident reports for technical and non-technical stakeholders.
Participate in a 24/7 on-call rotation.
Develop and maintain Python scripts for evidence collection, log parsing, IOC enrichment, and automated response actions.
Build and optimize automated response workflows in Tines to accelerate containment and reduce MTTR.
Create and tune detection rules in Elastic and SentinelOne based on investigative findings and emerging threat intelligence.
Integrate security tools to streamline incident response workflows and reduce manual effort.
Serve as the primary incident response point of contact for client stakeholders during active incidents.
Conduct client-facing incident briefings, root cause analysis presentations, and post-incident reviews.
Deliver actionable remediation guidance tailored to each client’s environment and risk tolerance.
Maintain SLA commitments for incident acknowledgment, updates, and resolution.
Contribute to client security posture assessments and incident response readiness recommendations.