Lead Endpoint Cybersecurity Engineer

TIAA is seeking a Lead Endpoint Cybersecurity Engineer to help drive enterprise endpoint cybersecurity technologies at scale. This onsite role in Dallas, TX combines hands-on engineering with senior technical leadership across Windows, macOS, Linux, VDI, and related server environments, including two strategic initiatives: an Enterprise Deception Framework and an AI Detection and Response (AIDR) capability.

You will lead the design, deployment, maintenance, testing, troubleshooting, and continuous improvement of endpoint controls, ensuring they operate reliably in production and integrate cleanly with existing security monitoring and response workflows.

What you’ll do

• Act as a technical lead for enterprise endpoint cybersecurity technologies across Windows, macOS, Linux, VDI, and server environments as applicable.
• Design, configure, deploy, maintain, upgrade, and troubleshoot endpoint cybersecurity applications and agents.
• Provide senior-level break/fix and problem-management support, including root-cause analysis for application failures, agent health issues, policy conflicts, deployment failures, integration failures, and endpoint instability.
• Drive application lifecycle activities such as upgrades, configuration changes, policy tuning, regression testing, deployment validation, and rollback planning.
• Create technical standards, runbooks, operating procedures, and engineering and support documentation.
• Identify opportunities for automation via scripting, APIs, configuration-management platforms, and other engineering mechanisms.
• Troubleshoot agent installation, upgrade, communications, policy, interoperability, and stability issues.
• Coordinate complex incidents with cybersecurity, infrastructure, desktop engineering, vendors, and application owners.
• Identify conflicts between existing and proposed cybersecurity agents and validate coexistence and upgrade paths.
• Perform stability, coexistence, upgrade, rollback, failure-mode, and regression testing, and document findings with technical go/no-go recommendations prior to production deployment.
• Establish performance monitoring after initial deployment waves.
• Engineer endpoint components of the Deception Framework across supported workstation and server populations, including proof-of-concept and production-readiness testing.
• Validate deceptive files, credentials, registry artifacts, sessions, processes, and related endpoint lures as appropriate to approved use cases.
• Test failure conditions to confirm endpoint stability when deception components are unavailable or impaired.
• Validate integration of Deception telemetry with enterprise security monitoring and response systems.
• Support deployment waves by troubleshooting installation, communications, configuration, and endpoint-side operational issues.
• Lead endpoint-engineering activities to deploy, integrate, validate, operate, and optimize TIAA’s enterprise cyber deception capability.
• Lead endpoint engineering and technical implementation activities for evaluating and deploying an endpoint-based AI Detection and Response capability focused on emerging AI and agentic-AI threats.
• Validate integration with existing EDR/XDR, SIEM, SOAR, and identity and security operational workflows.
• Conduct controlled performance testing to quantify CPU, memory, and other endpoint overhead.
• Ensure endpoint implementation adheres to architecture, privacy, security, change-management, and production-safety requirements.
• Assist with tuning and continuous improvement following production deployment.

Required qualifications

• University degree preferred
• 5+ years required; 7+ years preferred
• 5+ years experience with security technology POCs, product evaluations, and production deployments
• Hands-on experience engineering and supporting enterprise deception or other endpoint cybersecurity solutions
• Understanding of Zero Trust, endpoint hardening, security baselines, vulnerability management, and incident response
• Experience conducting endpoint application performance, compatibility, stability, and regression testing
• Technology/Engineering or equivalent professional experience
• CISSP, GIAC, Microsoft security certifications, CrowdStrike certifications, or comparable industry certifications
• Experience translating security architecture and risk requirements into endpoint engineering implementations
• Experience testing multiple concurrent cybersecurity agents for performance and interoperability
• Previous technical leadership or mentoring experience

Location, level, and pay

• Location: Dallas, TX (onsite)
• Career level: 8IC
• Base pay range: USD 124,000 - 154,000 per year
• Anticipated posting end date: 2026-10-30
• Physical requirements: Sedentary Work

Technologies: Windows, macOS, Linux, VDI, EDR/XDR, SIEM, SOAR, identity, CISSP, GIAC, Microsoft security certifications, CrowdStrike certifications.

Related skills: Accountability, Adaptability, Business Continuity Planning, Cloud Computing Security, Collaboration, Communication, Compliance, Consultative Communication, Cybersecurity, Detail-Oriented, General Risk Management, Network Security, Prioritizes Effectively.