Security Engineer

Legato Security

. Own endpoint detection and response across managed security customers .

Posted 10/26/2026full-timeRemote • Utah • United StatesJuniorMid-LevelWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in deploying and managing endpoint detection and response (EDR) solutions, with a strong focus on security operations and systems administration. Proficient in scripting and automation, with a solid understanding of security frameworks and compliance standards.

Highest-signal resume keywords

CrowdStrike Falcon DeploymentMicrosoft Defender for Endpoint ManagementSIEM Pipeline ManagementPowerShell ScriptingWindows Internals Administration

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Endpoint Detection And ResponseSystems AdministrationService TroubleshootingLog-Source OnboardingEvent ParsingField ExtractionsQuery CreationAPI IntegrationPolicy TuningMITRE ATT&CK Knowledge

Soft Skills

Excellent Writing Skills

Tools & Technologies

CrowdStrike FalconMicrosoft Defender For EndpointCarbon BlackSentinelOneSumo Logic Cloud SIEMMicrosoft SentinelStellar CyberIntuneSCCMJamf

Industry Keywords

MSSP OperationsMulti-Tenant OperationsNIST SP 800-53RMFFedRAMPFederal AuthorizationAssessment Processes

Tech Stack

Tools & technologies

CloudJamfLinuxMacOSPythonGo

About the role

Key responsibilities & impact

Own endpoint detection and response across managed security customers
Deploy, tune, and operate CrowdStrike Falcon, Microsoft Defender for Endpoint, Carbon Black, and SentinelOne
Manage SIEM pipelines and maintain healthy telemetry
Collaborate with Security Engineers and SOC Analysts to identify tools, techniques, and procedures
Translate customer needs and future goals into secure, effective solution plans
Investigate new techniques and help customers exceed industry standards
Design solutions, identify gaps, provide alternatives, and balance security with business needs
Administer multi-tenant EDR consoles, including RBAC, policy inheritance, and sensor update rings
Tune prevention and detection policies
Track sensor health and coverage
Administer EDR-to-SIEM pipelines into Sumo Logic Cloud SIEM, Microsoft Sentinel, and Stellar Cyber
Build and maintain API integrations between EDR platforms, SOAR, ticketing, and threat intelligence
Plan and run EDR deployments and migrations using Intune, SCCM, GPO, or Jamf

Requirements

What you’ll need

2+ years deploying or administering an enterprise EDR in production, plus 2+ years of systems administration
At least one EDR deployment or migration run end to end, including rollout, policy, exclusions, and handoff to operations
Experience with Windows internals and macOS/Linux administration
Experience troubleshooting service failures, system extensions, eBPF, AV conflicts, proxies, and TLS inspection
Active SIEM experience, including log-source onboarding, event parsing, field extractions, and query creation
PowerShell plus Python or Go, including scripting API access and endpoint deployment scripts
Working knowledge of MITRE ATT&CK and endpoint telemetry
Excellent writing skills for runbooks, incident summaries, and configuration guides
Preferred: 4+ years focused on CrowdStrike Falcon or SentinelOne, or production experience with multiple listed EDR products
Preferred: MSSP or multi-tenant operations experience
Preferred: Sysmon deployment and configuration tuning
Preferred: Federal/public-sector security experience, including NIST SP 800-53, RMF, FedRAMP, and federal authorization and assessment processes

Benefits

Comp & perks

Opportunity for advancement based on performance
Start-up culture with an office in downtown Salt Lake City, UT
Competitive medical and dental benefits for employee and family members
Short-term disability
Basic life insurance
Children’s orthodontia
Additional voluntary benefits available
401K match
Flexible Paid Time Off policy
Professional Development opportunities specific to role