Endpoint Security Engineer

A path for every ambition.

At HUB, we believe the best work happens when people are given real space to grow and then given the autonomy to exercise it. We power progress and protect ambition: for the clients who count on us, and equally for the people who make that possible every day.

We’re creative thinkers and determined doers, guided by values that show up in how we work together: with empathy, adaptability, accountability and a genuine commitment to one another’s success. We foster bold ideas, celebrate curiosity and share what we know. Because when people grow, the work they do grows with them.

Our purpose is deeply human: to help people navigate the world on their terms, at their speed, toward their future. We hold that same commitment to the people building careers here.

Whether you’re starting out or leveling up, you’ll find the resources to evolve, the support to take on more and a team ready to back you at every stage.

Your ambition has a home here.

A path for every ambition.

At HUB, we believe the best work happens when people are given real space to grow and then given the autonomy to exercise it. We power progress and protect ambition: for the clients who count on us, and equally for the people who make that possible every day.

We’re creative thinkers and determined doers, guided by values that show up in how we work together: with empathy, adaptability, accountability and a genuine commitment to one another’s success. We foster bold ideas, celebrate curiosity and share what we know. Because when people grow, the work they do grows with them.

Our purpose is deeply human: to help people navigate the world on their terms, at their speed, toward their future. We hold that same commitment to the people building careers here.

Whether you’re starting out or leveling up, you’ll find the resources to evolve, the support to take on more and a team ready to back you at every stage.

Your ambition has a home here.

Job Description

In this role, you will own the engineering and day-to-day management of HUB’s enterprise endpoint detection and response (EDR) platform, including policy design, exclusion governance, agent lifecycle, and detection tuning. You will also assess the EDR solutions inherited through mergers and acquisitions (M&A), measuring configuration and policy parity against HUB’s standard EDR baseline to guide integration, migration, or coexistence decisions. This position is part of the Security Operations and Engineering team and works in close collaboration with Security Operations, Incident Response, Governance & Compliance, M&A integration teams, and HUB IT teams to deliver effective, measurable endpoint protection for Hub International.

Objectives of this Role

• Serve as the technical owner of HUB’s enterprise EDR platform, ensuring it is deployed, healthy, and operating at required levels of coverage, service, and availability across all supported endpoints and servers.

• Design, document, and maintain EDR policies, policy tiers, and group or site structures aligned to HUB security standards and operating system and workload types.

• Manage the exclusion lifecycle, including intake, risk review, approval, implementation, periodic recertification, and retirement, so exclusions are justified, scoped as narrowly as possible, and auditable.

• Assess the EDR solutions of acquired and to-be-acquired organizations by building and executing a repeatable, platform-neutral parity-assessment methodology covering configuration, policy settings, exclusion handling, detection and prevention coverage, and operational fit against the HUB EDR baseline.

• Produce parity matrices and gap analyses that map HUB’s baseline EDR configuration and policies to the equivalent controls in each acquired entity’s EDR platform, clearly documenting where parity is full, partial, or not achievable and what remediation or compensating controls are needed.

• Contribute to continuous improvement of response playbooks, detection content, and endpoint security tooling and posture.

• Contribute to operations KPIs that measure endpoint coverage, agent health, detection quality, and exclusion hygiene.

• Maintain current knowledge of endpoint threats, EDR/XDR technology, and adversary techniques, bringing forward ideas for modernization and improvement.

• Be available for critical security incident response that requires immediate endpoint containment, investigation, or remediation.

• Engage with peers regularly on endpoint security operations, project status, activities, and achievements.

• Contribute to security requirements, standards, procedures, and reference architectures for endpoint protection in compliance with HUB policies and technical standards.

Daily and Monthly Responsibilities

• Monitor EDR console health, agent coverage, agent version compliance, and policy drift; remediate unhealthy, outdated, or unmanaged endpoints in partnership with IT.

• Review and triage endpoint alerts and threat detections, tune detections to reduce false positives, and escalate confirmed incidents to Security Operations and Incident Response.

• Process exclusion requests: validate business justification, assess risk, scope by path, hash, certificate, or process as appropriate, implement approved exclusions, and maintain a central exclusion register with owners and review dates.

• Perform scheduled recertification of existing exclusions and remove those that are stale, overly broad, or no longer required.

• Plan, test, and stage agent upgrades, policy changes, and console configuration changes using pilot rings and documented change-management practices.

• Maintain endpoint automation, integrations, and reporting using platform APIs, SIEM integrations, SOAR playbooks, and scripting.

• Conduct EDR assessments for M&A targets and newly acquired entities: review tenant configuration, policies, exclusions, agent coverage, and detection settings, and compare them against the HUB EDR baseline to identify gaps and risk.

• Maintain configuration and policy parity documentation for each acquired entity, including side-by-side mappings to the HUB baseline, identified gaps, compensating controls, and recommended paths (remediate in place, migrate to the HUB platform, or coexist).

• Contribute to root-cause analysis for security incidents and events, and establish preventive measures, mitigations, or remediations.

• Contribute to weekly and monthly posture and response operations reporting, including endpoint coverage, exclusion metrics, and platform evaluation status.

• Assist in configuring new applications and infrastructure for needed endpoint and security telemetry.

• Contribute to analysis and recommendations for upgrades, changes, and implementations that support the scaling of HUB’s security operations.

• Support M&A due diligence and post-close integration planning by providing endpoint security findings, migration effort estimates, and risk summaries to Security leadership and integration teams.

• Manage platform support cases and escalations, and track product roadmap items relevant to HUB.

• Support the HUB Information Security Governance & Compliance team as needed during risk assessments, internal and external information security audits, and third-party reviews.

Skills and Qualifications

• Bachelor’s degree in technology or applicable experience.

• Related certifications (e.g., EDR platform administrator certifications, GSEC, GCIH, GCFE/GCFA, CISSP, AWS) preferred.

• 5+ years of experience in information security operations or engineering, including 3+ years administering and engineering enterprise EDR platforms; hands-on experience with a leading enterprise EDR platform required.

• Demonstrated experience designing endpoint security policies and managing exclusions at enterprise scale, including balancing protection, application compatibility, and performance.

• Experience assessing, integrating, or migrating between EDR/XDR products commonly found in acquired environments, including mapping configuration and policy equivalency between platforms; M&A security integration experience preferred.

• Strong knowledge of Windows, macOS, and Linux internals relevant to endpoint security, including process behavior, file system and registry activity, and common attack techniques mapped to MITRE ATT&CK.

• Experience with endpoint deployment and management tooling (e.g., MDM, software distribution, and configuration management platforms), and with Active Directory / MS Entra ID.

• 3+ years of experience with security incident response and operations, including endpoint investigation, containment, and remediation.

• 3+ years of experience with cloud infrastructure (AWS, GCP, Azure) and O365 services and technology.

• 2+ years of experience defining, refining, and driving efficiency in operational processes.

• Experience with SIEM and SOAR technologies, and with KQL, SPL, or other query languages, including EDR threat-hunting query languages.

• Experience with PowerShell, Python, and shell scripting, and with REST APIs for automation and reporting.

• Working knowledge of TCP/IP, DNS, and network and Windows Event logging.

• Knowledge of information security standards, principles, and practices, and of regulatory and compliance requirements such as ISO 27001, NIST 800-53, SOC 2, PCI, and SOX, particularly as they apply to endpoint controls and exception management.

• Knowledge of email transmission, routing, and authentication concepts, including SMTP, SPF, DKIM, and DMARC.

• Strong prioritization, decision-making, critical thinking, documentation, communication, and relationship-building skills.

• Ability to work independently and in a team environment.

Pay transparency

The expected salary range for this position is $130,000- $140,000 and will be impacted by factors such as the successful candidate’s skills, experience and working location, as well as the specific position’s business line, scope and level. HUB International is proud to offer comprehensive benefit and total compensation packages: health/dental/vision/life/disability insurance, FSA, HSA and 401(k) accounts, paid-time-off benefits such as vacation, sick, and personal days, and eligible bonuses, equity and commissions for some positions.

The HUB difference

HUB International is one of North America’s largest insurance brokers, delivering risk management, insurance, employee benefits, retirement and wealth management solutions to businesses and individuals across the United States and Canada — through locally led teams backed by national expertise, giving you the agility of a local partner and the reach of a global organization.

What we offer you

We invest in your growth. HUB offers structured training, licensing support, and ongoing development opportunities designed to accelerate your career. Benefits and programs vary based on employment status, role, location, and applicable eligibility requirements.

• Competitive pay with comprehensive health benefits, retirement savings matching, and company-paid life and disability plans
• Generous paid time off, paid parental leave and a wellbeing program designed to support real work/life balance
• A collaborative, high-performing culture with meaningful engagement, community impact through HUB Gives and genuine room to grow your career

The HUB difference

HUB International is one of North America’s largest insurance brokers, delivering risk management, insurance, employee benefits, retirement and wealth management solutions to businesses and individuals across the United States and Canada — through locally led teams backed by national expertise, giving you the agility of a local partner and the reach of a global organization.

Equal Employment Opportunity: HUB International Limited is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.

E-Verify: HUB International Limited participates in E-Verify. Please refer to Our Recruiting Process | Applicant Notices: E-Verify Program for additional information.