REMOTE - Sr. Security Engineer - Identity & Endpoint

Fortellar•Chicago, IL

1d•$130,000 - $155,000•Remote

About The Position

The Sr. Security Engineer, Identity & Endpoint designs, deploys, and operates identity, privileged access, vulnerability, endpoint, and device trust controls for Fortellar clients. The role is primarily assigned to large-scale, multi-workstream security remediation engagements and typically owns a substantial, dependency-critical portion of the program. Conditional Access design is a key dependency for device-compliance enforcement and is commonly a major critical path in delivery. Engagements may include hybrid identity environments using Microsoft Entra ID and on-premises Active Directory with directory synchronization, managed workstations and Windows Server, Microsoft Intune, and Microsoft Defender for Endpoint. This hands-on engineering role involves direct client exposure and accountability for changes that could deny access to an entire workforce. The engineer is expected to use sound judgment to pilot, stage, halt, or defer rollouts as appropriate, and to explain those decisions directly to client stakeholders. The role requires deep Microsoft identity and endpoint expertise, disciplined change management, strong verbal and written communication, and the professional presence to represent Fortellar to client technical staff and executives, both in person and virtually. Travel to client sites is required 10%–20%. The role is open only to candidates who currently live and are authorized to work in the United States. Applications must be submitted from within the U.S.; applications submitted from a location that does not match the candidate’s stated location will not be considered.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field.
At least 8 years in infrastructure or security engineering, including at least 5 years in hybrid identity involving Entra ID and on-premises Active Directory.
At least 4 years deploying Microsoft Intune and Defender for Endpoint at enterprise scale.
Proven experience designing Conditional Access, phishing-resistant MFA, and Privileged Identity Management for 1,000 or more users.
At least 3 years in a client-facing consulting role, presenting to technical and executive stakeholders.
Track record of leading high-risk changes through formal change management using pilots, staged rollouts, and rollback plans.
Deep Microsoft identity and endpoint expertise, disciplined change management, strong verbal and written communication, and professional presence with client stakeholders.
Ability to travel 10%–20% to client sites.
Must currently live and be authorized to work in the United States; applications must be submitted from within the U.S. and match the candidate’s stated location.

Nice To Haves

Preferred certifications: SC-300, MD-102, AZ-500, SC-100, or CISSP.

Responsibilities

Design and enforce phishing-resistant multifactor authentication for administrators and multifactor authentication for the full user population using modern methods such as FIDO2 security keys, Windows Hello for Business, and passkeys.
Reduce privileged directory role membership to a justified minimum, remove dormant and stale accounts from sensitive groups, and produce a privileged-overlap map between Microsoft Entra ID and on-premises Active Directory.
Remediate domain-dominance exposure, including rotating the krbtgt account, removing delegation from privileged accounts, and migrating the directory synchronization connector to a dedicated least-privilege identity.
Redesign Conditional Access around defined user and administrator personas and apply role-based access control.
Implement Privileged Identity Management with just-in-time elevation, and enforce sign-in frequency and non-persistent administrator sessions.
Evaluate, select, deploy, and operate privileged access management and identity governance capability, and establish quarterly access recertification as a business-as-usual process.
Remediate vulnerabilities carrying published exploit code and observed exploitation in the wild as emergency changes under the client's emergency change authority.
Author and publish a vulnerability management procedure and workstation patch service level that matches the standard operating for servers.
Deploy Windows Autopatch and Microsoft Intune update rings, and reconcile Active Directory, Intune, and Defender device populations into a single authoritative asset inventory.
Complete application dependency mapping before retiring legacy authentication protocols and enforcing LDAP server signing and channel binding.
Deploy security baselines in staged waves across managed endpoints and remove or formally risk-accept end-of-support systems and software.
Close local administrator credential management gaps, operate certificate lifecycle management with expiry alerting, and detect unauthorized software.
Review exposure score, remediation activity, and threat intelligence on a defined cadence, prioritizing exploit availability and observed threat activity rather than severity score alone.
Enforce the client's ratified bring-your-own-device position, including restricting corporate content synchronization to managed devices.
Deploy Microsoft Intune application protection policies across Microsoft 365 mobile applications and execute the mobile application and device management plan across a previously unmanaged mobile estate.
Harden connected software-as-a-service applications, including multifactor authentication enforcement and session timeout configuration.
Require a compliant or hybrid-joined device through Conditional Access, enable remote wipe for devices holding organizational data, and apply session controls for unmanaged browsers.
Establish the device attestation cycle within joiner, mover, and leaver processes, and report on unmanaged access attempts on a defined cadence.
Design and operate pilot rings and staged rollouts for every change capable of denying user or administrator access, with documented rollback and tested break-glass accounts.
Prepare, submit, and present change records to the client's change process, including risk, blast radius, validation steps, and backout plan.
Execute changes during scheduled maintenance windows, including evenings and weekends where changes cannot safely be made during business hours.
Halt or defer rollouts when validation is incomplete and promptly communicate the decision and schedule consequence to the engagement lead and client.