Endpoint Security Engineer

Work on enterprise endpoint detection and response for one of North America’s largest insurance brokers, with a role that combines engineering ownership, incident readiness, and measurable security operations outcomes. HUB International supports locally led teams backed by national expertise, giving you the agility of a local partner and the reach of a global organization. This Chicago, IL onsite position includes comprehensive benefits, training and licensing support, and a collaborative, high-performing culture.

The Endpoint Security Engineer will own HUB International’s enterprise EDR platform, including day-to-day operations, policy design, exclusion governance, agent lifecycle management, and detection tuning. You will also support security operations and incident response by assessing inherited EDR solutions from M&A targets and maintaining parity against HUB’s EDR baseline.

Responsibilities

• Serve as the technical owner for HUB’s enterprise EDR platform, ensuring deployment health and required coverage, service, and availability across supported endpoints and servers.
• Design, document, and maintain EDR policies, including policy tiers and group or site structures aligned to HUB security standards and operating system or workload types.
• Manage the exclusion lifecycle from intake through risk review, approval, implementation, periodic recertification, and retirement, ensuring exclusions are justified, scoped narrowly, and auditable.
• Assess EDR solutions for acquired and to-be-acquired organizations using a repeatable, platform-neutral parity assessment methodology covering configurations, policy settings, exclusion handling, detection and prevention coverage, and operational fit.
• Create parity matrices and gap analyses mapping HUB baseline EDR configuration and policies to equivalent controls in each acquired environment, documenting parity status and required remediation or compensating controls.
• Contribute to continuous improvement across response playbooks, detection content, and endpoint security tooling and posture.
• Support operations KPIs related to endpoint coverage, agent health, detection quality, and exclusion hygiene.
• Maintain current knowledge of endpoint threats, EDR/XDR technology, and adversary techniques, including recommendations for modernization and improvement.
• Be available for critical incident response requiring immediate endpoint containment, investigation, or remediation.
• Collaborate with peers on endpoint security operations, project status, activities, and achievements.
• Contribute to endpoint protection requirements, standards, procedures, and reference architectures for compliance with HUB policies and technical standards.
• Monitor EDR console health, agent coverage, agent version compliance, and policy drift; remediate unhealthy, outdated, or unmanaged endpoints with IT partners.
• Review and triage endpoint alerts and threat detections, tune to reduce false positives, and escalate confirmed incidents to Security Operations and Incident Response.
• Process exclusion requests by validating business justification, assessing risk, scoping by path/hash/certificate/process as appropriate, implementing approved exclusions, and maintaining a central exclusion register with owners and review dates.
• Perform scheduled recertification of existing exclusions and remove stale or overly broad exceptions.
• Plan, test, and stage agent upgrades, policy changes, and console configuration changes using pilot rings and documented change-management practices.
• Maintain endpoint automation, integrations, and reporting using platform APIs, SIEM integrations, SOAR playbooks, and scripting.
• Support M&A due diligence and post-close integration planning with endpoint security findings, migration effort estimates, and risk summaries to Security leadership and integration teams.
• Manage platform support cases and escalations, track product roadmap items relevant to HUB, and support the HUB Information Security Governance & Compliance team during risk assessments, internal and external audits, and third-party reviews as needed.

Requirements

• Bachelor’s degree in technology or applicable experience.
• Related certifications (e.g., EDR platform administrator certifications, GSEC, GCIH, GCFE/GCFA, CISSP, AWS) preferred.
• 5+ years of experience in information security operations or engineering, including 3+ years administering and engineering enterprise EDR platforms; hands-on experience with a leading enterprise EDR platform required.
• Demonstrated experience designing endpoint security policies and managing exclusions at enterprise scale, balancing protection, application compatibility, and performance.
• Experience assessing, integrating, or migrating between EDR/XDR products in acquired environments, including mapping configuration and policy equivalency between platforms; M&A security integration experience preferred.
• Strong knowledge of Windows, macOS, and Linux internals relevant to endpoint security, including process behavior, file system and registry activity, and common attack techniques mapped to MITRE ATT&CK.
• Experience with endpoint deployment and management tooling (MDM, software distribution, configuration management platforms) and Active Directory / MS Entra ID.
• 3+ years of experience with security incident response and operations, including endpoint investigation, containment, and remediation.
• 3+ years of experience with cloud infrastructure (AWS, GCP, Azure) and O365 services and technology.
• 2+ years of experience defining, refining, and driving efficiency in operational processes.
• Experience with SIEM and SOAR technologies, and with KQL, SPL, or other query languages, including EDR threat-hunting query languages.
• Experience with PowerShell, Python, and shell scripting, and with REST APIs for automation and reporting.
• Working knowledge of TCP/IP, DNS, and network and Windows Event logging.
• Knowledge of information security standards and practices, and regulatory requirements such as ISO 27001, NIST 800-53, SOC 2, PCI, and SOX as they apply to endpoint controls and exception management.
• Knowledge of email transmission, routing, and authentication concepts including SMTP, SPF, DKIM, and DMARC.
• Strong prioritization, decision-making, critical thinking, documentation, communication, and relationship-building skills; ability to work independently and in a team environment.

Tech Stack

• EDR, XDR, EDR console, SIEM, SOAR
• MDM, Active Directory, MS Entra ID
• Windows, macOS, Linux
• MITRE ATT&CK, KQL, SPL
• PowerShell, Python, shell scripting, REST APIs
• TCP/IP, DNS, Windows Event logging
• SMTP, SPF, DKIM, DMARC
• AWS, GCP, Azure, O365

Benefits

• Health/dental/vision/life/disability insurance
• FSA and HSA
• 401(k) accounts and retirement savings matching
• Paid-time-off benefits such as vacation, sick, and personal days, plus generous paid time off
• Eligible bonuses
• Equity and commissions for some positions
• Structured training, licensing support, and ongoing development opportunities
• Company-paid life and disability plans
• Paid parental leave
• A wellbeing program designed to support real work/life balance
• A collaborative, high-performing culture
• Community impact through HUB Gives

Pay Transparency

The expected salary range for this position is $130,000-$140,000 per year. Offer amounts may vary based on the successful candidate’s skills, experience, and working location, as well as the specific position’s business line, scope, and level.

Equal Employment Opportunity

HUB International Limited is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.

Reasonable Accommodations

HUB International Limited is committed to providing reasonable accommodations to qualified individuals with disabilities throughout the application and hiring process. If you need an accommodation to access the career site, complete an application, or participate in any part of the hiring process, contact the Recruiting Team at [email protected]. This contact information is for accommodation requests only and should not be used to inquire about the status of an application.

E-Verify

HUB International Limited participates in E-Verify. Please refer to Our Recruiting Process | Applicant Notices: E-Verify Program for additional information.