Security Engineering Manager

Role overview

Endpoint security program

• Operate and improve endpoint security tooling, including EDR, DLP, ZTNA, PAM, and EPM.
• Track agent coverage, policy drift, false-positive rates, and other tool health metrics; report results to leadership.
• Own tooling upgrades, migrations, consolidation, documentation, and standard operating procedures.
• Evaluate emerging tools and threats and recommend changes to strategy and standards.
• Administer, test, and roll out security policies while avoiding impact to users and business operations.

MDR vendor oversight

• Own the MDR vendor relationship and performance management.
• Oversee Tier 1 and Tier 2 alert triage and investigations; monitor SLAs, escalation quality, and detection coverage.
• Drive corrective action plans and coordinate Tier 3 remediation with IT, Engineering, and Cloud Operations.
• Act as the internal escalation point for significant or ambiguous alerts.

Incident response and leadership

• Own incident response processes, procedures, and playbooks and keep them current.
• Design, facilitate, and report on annual tabletop exercises; improve readiness using exercise outcomes, incidents, and industry lessons.
• Lead or coordinate cross-functional response to significant security events.
• Coordinate daily security activities and provide technical guidance to internal analysts and external service providers.

Requirements

• Experienced security professional with hands-on responsibility for security tooling and incident response.
• Provide technical leadership and own security programs as an individual contributor; the role has no direct reports.
• Coordinate across IT, Engineering, Cloud Operations, business leadership, vendors, and service providers.