Information Security Architect – Endpoint Security / EDR-XDR

What You'll Do

• Endpoint Security Architecture & Strategy Define and own the enterprise endpoint security architecture and technical strategy across Windows, Linux, and macOS environments.
• Develop and maintain the strategic roadmap for EDR, XDR, endpoint protection, endpoint detection, threat prevention, and response capabilities.
• Establish enterprise endpoint security architecture principles, standards, reference architectures, and technology patterns.
• Architect and govern EDR/XDR solutions for large-scale, geographically distributed, and heterogeneous enterprise environments.
• Define security architecture requirements for endpoint protection, detection, telemetry, prevention, isolation, remediation, and threat hunting.
• Evaluate current-state endpoint security capabilities and develop target-state architectures and transformation roadmaps.
• Assess and recommend EDR/XDR technologies based on security effectiveness, scalability, operational impact, integration capabilities, and total cost of ownership.
• Define architectural requirements for endpoint security integrations with SIEM, SOAR, IAM, vulnerability management, ITSM, cloud security, network security, and other enterprise security platforms.
• Establish architecture patterns for onboarding new business units, platforms, cloud workloads, and acquired environments into the enterprise endpoint security ecosystem.
• Ensure endpoint security architecture supports Zero Trust and defense-in-depth security strategies.
• Develop technology-agnostic security requirements and evaluation criteria for EDR/XDR platforms.
• EDR/XDR Architecture Serve as the senior technical authority and architecture SME for the enterprise EDR/XDR capability.
• Define the architecture, deployment model, organizational structure, policy hierarchy, and security control framework for EDR/XDR platforms.
• Establish enterprise standards for EDR/XDR policies, exclusions, application controls, agent configurations, security controls, and endpoint segmentation.
• Define architectural approaches for endpoint coverage, agent health, telemetry collection, detection, response, and centralized management.
• Develop scalable designs for EDR/XDR across thousands of enterprise endpoints and diverse operating-system environments.
• Establish architecture and governance standards for agent lifecycle management, upgrades, configuration changes, and platform enhancements.
• Design integration patterns between EDR/XDR platforms and enterprise SIEM, SOAR, SOC, ticketing, vulnerability management, identity, and cloud security platforms.
• Evaluate and guide capabilities such as endpoint telemetry, behavioral detection, threat hunting, automated response, remediation, isolation, rollback, and forensic investigation.
• Provide architectural guidance for managed detection and response (MDR) capabilities where applicable.
• Review and approve significant EDR/XDR configuration, architecture, and policy changes from an architecture and security-risk perspective.
• Ensure EDR/XDR solutions are implemented consistently while allowing appropriate flexibility for different business, technology, and risk requirements.
• Threat Detection & Security Architecture Define endpoint detection and response architecture aligned with current threat intelligence and adversary behaviors.
• Develop enterprise detection and response strategies mapped to frameworks such as MITRE ATT&CK.
• Establish architectural requirements for endpoint telemetry, behavioral detection, process monitoring, command-line visibility, network activity, and endpoint threat intelligence.
• Partner with Security Operations and Incident Response teams to improve endpoint detection and response capabilities.
• Provide architecture guidance for threat hunting and advanced endpoint investigation.
• Analyze emerging attack techniques, malware trends, persistence mechanisms, lateral movement techniques, and endpoint-based attack vectors.
• Define security controls to detect and mitigate common endpoint attack techniques.
• Define requirements for automated and analyst-driven endpoint containment and remediation.
• Participate in complex security investigations and provide architectural guidance during major incidents.
• Conduct post-incident architecture reviews and recommend improvements to endpoint security controls.
• Endpoint Security Engineering & Standards Define enterprise endpoint security baselines and technical security standards.
• Establish hardened endpoint configuration requirements and security control frameworks.
• Develop reference architectures for Windows, Linux, and macOS endpoint security.
• Define security requirements for endpoint management technologies including Intune, SCCM/MECM, Jamf, Ansible, and similar platforms.
• Partner with endpoint engineering teams to incorporate security controls into endpoint build and deployment processes.
• Provide architecture guidance for vulnerability management, endpoint hardening, application control, and attack-surface reduction.
• Define security requirements for endpoint provisioning, configuration, lifecycle management, and decommissioning.
• Establish technical standards for endpoint security exceptions, exclusions, risk acceptance, and compensating controls.
• Ensure endpoint security architecture supports CIS benchmarks, organizational security standards, audit requirements, and regulatory obligations.
• Review proposed infrastructure and technology changes for endpoint security implications.
• Enterprise Security Architecture & Integration Partner with enterprise and solution architects to ensure endpoint security is integrated into the broader enterprise security architecture.
• Define security architecture requirements for integrations between endpoint, identity, network, cloud, application, and security operations platforms.
• Develop security architecture diagrams, data-flow diagrams, reference designs, and technical standards.
• Evaluate security implications of new technologies, applications, infrastructure platforms, and cloud services.
• Ensure endpoint security telemetry and controls integrate effectively with enterprise security monitoring and analytics platforms.
• Define requirements for security automation and orchestration to improve detection, response, and operational efficiency.
• Partner with SOC and security engineering teams to identify opportunities for automation and workflow optimization.
• Security Governance, Risk & Compliance Establish endpoint security architecture governance, standards, and control requirements.
• Participate in architecture review boards and technology governance processes.
• Assess endpoint security risks and recommend appropriate technical controls and mitigating architectures.
• Review security exceptions and provide risk-based recommendations.
• Support internal and external audits by providing endpoint security architecture, standards, and control documentation.
• Ensure endpoint security designs align with applicable regulatory, compliance, and organizational requirements.
• Define metrics and key performance indicators for endpoint security architecture, coverage, control effectiveness, and risk reduction.
• Develop executive-level reporting on endpoint security posture, architecture maturity, and strategic initiatives.
• Enterprise Transformation & Mergers/Acquisitions Provide security architecture leadership for mergers, acquisitions, divestitures, and major technology transformations.
• Define architecture and migration strategies for integrating acquired environments into the enterprise endpoint security ecosystem.
• Assess security architectures, endpoint technologies, EDR/XDR platforms, policies, and security controls within acquired environments.
• Develop transition roadmaps to standardize endpoint security capabilities across newly integrated organizations.
• Identify architectural gaps, security risks, technical debt, and integration challenges.
• Lead or provide technical oversight for large-scale endpoint security transformation initiatives.
• Technical Leadership & Collaboration Serve as a senior technical advisor and subject-matter expert for endpoint security and EDR/XDR.
• Provide technical leadership and architectural direction to security engineers and infrastructure teams.
• Collaborate with SOC, Incident Response, Network Security, Cloud Security, Identity, Infrastructure, IT, and Application teams.
• Translate complex security requirements into practical and scalable technical architectures.
• Mentor engineers and security professionals on endpoint security architecture, EDR/XDR, threat detection, and incident response.