Senior Security Engineer – Identity & Endpoint

Fortellar

. Design, deploy, and operate identity, privileged access, vulnerability, endpoint, and device trust controls for Fortellar’s clients .

Posted 11/9/2026full-timeRemote • United StatesSenior💰 $130,000 - $155,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in designing and implementing identity and access management solutions, including Conditional Access and phishing-resistant MFA, while managing security remediation and vulnerability management processes. Proven ability to lead client engagements and communicate effectively with technical and executive stakeholders.

Highest-signal resume keywords

Hybrid Identity ManagementConditional Access DesignPhishing-Resistant MFA ImplementationMicrosoft Intune DeploymentPrivileged Identity Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Identity GovernanceVulnerability ManagementEndpoint SecurityAccess ControlActive Directory ManagementSecurity RemediationDevice Trust ControlsChange ManagementWindows AutopatchLDAP Server Signing

Soft Skills

Client-Facing ConsultingCommunicationStakeholder PresentationLeadershipCollaboration

Tools & Technologies

Microsoft IntuneDefender for EndpointFIDO2 Security KeysWindows Hello for BusinessBYOD ControlsSaaS Applications HardeningMobile Application Management

Certifications & Qualifications

SC-300MD-102AZ-500SC-100CISSP

Industry Keywords

Infrastructure EngineeringSecurity EngineeringAccess RecertificationThreat IntelligenceChange Records

About the role

Key responsibilities & impact

Design, deploy, and operate identity, privileged access, vulnerability, endpoint, and device trust controls for Fortellar’s clients
Support large-scale, multi-workstream security remediation engagements
Design and enforce phishing-resistant MFA for administrators and MFA for the full user population using FIDO2 security keys, Windows Hello for Business, and passkeys
Reduce privileged directory role membership and remediate domain-dominance exposure
Redesign Conditional Access around user and administrator personas and apply role-based access control
Implement Privileged Identity Management with just-in-time elevation and enforce sign-in frequency and non-persistent administrator sessions
Evaluate, select, deploy, and operate privileged access management and identity governance capabilities
Establish quarterly access recertification
Remediate vulnerabilities with published exploit code or observed exploitation
Author and publish vulnerability management procedures and workstation patch service levels
Deploy Windows Autopatch and Microsoft Intune update rings
Reconcile Active Directory, Intune, and Defender device populations into a single authoritative asset inventory
Map application dependencies and retire legacy authentication protocols
Enforce LDAP server signing and channel binding
Deploy security baselines in staged waves and address end-of-support systems and software
Manage local administrator credentials and certificate lifecycles
Review exposure scores, remediation activity, and threat intelligence on a defined cadence
Enforce BYOD controls, deploy Intune application protection policies, and execute mobile application and device management plans
Harden SaaS applications, require compliant or hybrid-joined devices, enable remote wipe, and apply unmanaged-browser session controls
Establish device attestation within joiner, mover, and leaver processes
Design and operate pilot rings, staged rollouts, rollback procedures, and break-glass accounts
Prepare and present change records, execute changes during maintenance windows, and halt or defer unsafe rollouts
Communicate rollout decisions and schedule consequences to engagement leads and clients

Requirements

What you’ll need

Bachelor’s degree in Computer Science, Information Security or a related field
8+ years in infrastructure or security engineering, including 5+ years in hybrid identity (Entra ID and on-premises AD)
4+ years deploying Microsoft Intune and Defender for Endpoint at enterprise scale
Proven experience designing Conditional Access, phishing-resistant MFA and Privileged Identity Management for 1,000+ users
3+ years in a client-facing consulting role, presenting to technical and executive stakeholders
Track record of leading high-risk changes through formal change management, using pilots, staged rollouts and rollback plans
Preferred certifications: SC-300, MD-102, AZ-500, SC-100 or CISSP
Must currently live and be authorized to work in the United States
Applications must be submitted from within the U.S.
Must be able to travel 10%–20% to client sites