Senior Security Engineer – Identity & Endpoint

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, implement, and manage identity, privileged access, vulnerability, endpoint, and device trust controls for Fortellar’s clients.

• Assist with extensive, multi-workstream security remediation projects.

• Create and enforce phishing-resistant multi-factor authentication (MFA) for administrators and MFA for the entire user base utilizing FIDO2 security keys, Windows Hello for Business, and passkeys.

• Decrease privileged directory role memberships and address domain-dominance vulnerabilities.

• Revamp Conditional Access based on user and administrator roles and implement role-based access control.

• Deploy Privileged Identity Management with just-in-time elevation and enforce sign-in frequency along with non-persistent administrator sessions.

• Assess, choose, implement, and manage privileged access management and identity governance capabilities.

• Set up quarterly access recertification processes.

• Address vulnerabilities with known exploit code or documented exploitation.

• Develop and publish procedures for vulnerability management and workstation patch service levels.

• Implement Windows Autopatch and Microsoft Intune update rings.

• Consolidate Active Directory, Intune, and Defender device inventories into a unified authoritative asset inventory.

• Map application dependencies and phase out outdated authentication protocols.

• Enforce LDAP server signing and channel binding protocols.

• Roll out security baselines in staged phases and manage end-of-support systems and software.

• Oversee local administrator credentials and certificate lifecycle management.

• Review exposure metrics, remediation efforts, and threat intelligence on a scheduled basis.

• Implement BYOD controls, deploy Intune application protection policies, and execute mobile application and device management strategies.

• Strengthen SaaS applications, mandate compliant or hybrid-joined devices, enable remote wipe capabilities, and apply controls for unmanaged browser sessions.

• Establish device attestation processes for joiners, movers, and leavers.

• Design and manage pilot programs, staged rollouts, rollback strategies, and break-glass accounts.

• Prepare and present change logs, execute changes during maintenance periods, and pause or delay unsafe rollouts.

• Communicate rollout decisions and schedule impacts to engagement leads and clients.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Information Security, or a related discipline.

• Over 8 years of experience in infrastructure or security engineering, with at least 5 years focused on hybrid identity (Entra ID and on-premises AD).

• At least 4 years of experience deploying Microsoft Intune and Defender for Endpoint at an enterprise level.

• Demonstrated expertise in designing Conditional Access, phishing-resistant MFA, and Privileged Identity Management for more than 1,000 users.

• Minimum of 3 years in a client-facing consulting role, delivering presentations to both technical and executive audiences.

• Proven ability to lead high-risk changes through formal change management processes, utilizing pilots, staged rollouts, and rollback plans.

• Preferred certifications include SC-300, MD-102, AZ-500, SC-100, or CISSP.

• Must currently reside in and have authorization to work in the United States.

• Applications must be submitted from within the U.S.

• Willingness to travel 10%–20% to client sites.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance plans.

• Retirement savings plan with company matching contributions.

• Opportunities for professional development and continuous learning.

• Flexible work environment and remote work options.