[Hiring] Security Engineer @Legato Security

Role Description

Legato Security is hiring a Security Engineer to own endpoint detection and response across our managed security customers. You'll be our subject matter expert to help deploy, tune, and run CrowdStrike Falcon, Microsoft Defender for Endpoint, Carbon Black, and SentinelOne in customer environments, as well as managing the SIEM pipelines that keep telemetry healthy.

You’ll work with in-house teams (including other Security Engineers on our team, and SOC Analysts) to identify the right mix of tools, techniques, and procedures to translate our customer’s needs and future goals into a plan that will enable secure and effective solutions. In determining the best solutions, you will:

• Investigate new techniques
• Break free from the legacy model
• Help customers exceed industry standards
• Take a critical approach to solution design
• Identify gaps, provide alternatives, and customize solutions

This position is open to remote personnel anywhere within the U.S.

Qualifications

• 2+ years deploying or administering an enterprise EDR (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or comparable) in production, plus 2+ years of systems administration
• At least one EDR deployment or migration you ran end to end: Rollout, policy, exclusions, and handoff to operations
• Experience with Windows internals and macOS/Linux administration to troubleshoot sensor problems, such as service failures, system extensions, eBPF, AV conflicts, proxies, and TLS inspection
• Active experience with SIEM work, e.g. onboarding of log sources, event parsing, field extractions, and query creation across a variety of tools
• PowerShell plus Python or Go, including scripting API access and endpoint deployment scripts
• Working knowledge of MITRE ATT&CK and how attacker techniques show up in endpoint telemetry
• Excellent writing skills for creating runbooks, incident summaries, and configuration guides

Requirements

• 4+ years focused on CrowdStrike Falcon or SentinelOne, or production experience with more than one of the following EDR products: Falcon, Defender for Endpoint, and SentinelOne
• MSSP or other multi-tenant operations experience
• Sysmon deployment and configuration tuning, for customers without a commercial EDR or as extra visibility alongside one
• Experience supporting federal or public-sector environments: NIST SP 800-53 controls, the Risk Management Framework, FedRAMP, and federal security authorization and assessment processes

Benefits

• Start-up company in a growth phase with opportunity for advancement based on performance
• Start-up culture with an office in downtown Salt Lake City, UT
• Competitive medical and dental benefits for employee and family members
• Other company-provided benefits such as short-term disability, basic life insurance, children’s orthodontia, with additional voluntary benefits available, and 401K match
• Flexible Paid Time Off policy
• Professional Development opportunities specific to role