{"id":3871567,"url":"https://alion.io/job/fortellar-remote-sr-security-engineer-identity-endpoint","title":"REMOTE - Sr. Security Engineer - Identity & Endpoint","company":{"id":676107,"name":"Fortellar","domain":"fortellar.com","url":"https://alion.io/company/fortellar","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Rippling","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":130000,"max":155000,"currency":"USD","period":"year","gross":null,"usd_annual":155000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"LDAP","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Windows","optional":false},{"name":"Windows Server","optional":false}],"status":"live","first_seen_at":"2026-11-06T11:56:13Z","employer_posted_date":null,"last_verified_at":"2026-11-06T11:56:13Z","board_verified":false,"closed_at":null,"days_open":2,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":2},"description":"About Fortellar\n\nWe are a boutique IT consulting and business process outsourcing organization supporting mid to enterprise-level organizations. We are a small, but mighty, team of experts who know how to stretch, adapt, and put on any hat required in the moment to make our clients successful and enable Fortellar’s growth. Keys to success at Fortellar include:\n\nCollaboration: You demonstrate excellence in remote collaboration across your Fortellar and client teams. \n\nGrowth Mindset: You embrace personal growth and are always learning new things to support your team, your clients, and your personal goals. \n\nClient Success: You have a passion for your client’s success – you don’t just deliver to the contract you ensure that your client’s goals and needs are met.\n\nHumanity First: Honest and transparency are your natural instincts – your actions speak louder than your words and your team members love working with you.\n\nEntrepreneurial: You find a way to get it done, no matter what the challenges or seeming blockers are in front of you\n\nJob Description Summary\nThe Sr. Security Engineer, Identity & Endpoint designs, deploys, and operates identity, privileged access, vulnerability, endpoint, and device trust controls for Fortellar's clients, with primary assignment to large-scale, multi-workstream security remediation engagements. The role typically carries the largest and most dependency-critical share of such a program: the conditional access design this engineer produces is what gates device-compliance enforcement, and that sequence is commonly the longest critical path in the delivery plan. Engagements involve hybrid identity estates spanning Microsoft Entra ID and on-premises Active Directory joined by directory synchronization, managed workstation and Windows Server estates, Microsoft Intune, and Microsoft Defender for Endpoint.\n\nThis is a hands-on engineering role with direct client exposure. The engineer is accountable for changes capable of denying access to the client's entire workforce, and is expected to exercise the judgment to pilot, stage, and where necessary halt a rollout, and to explain that decision to client stakeholders directly. The role requires deep Microsoft identity and endpoint expertise, disciplined change management, strong verbal and written communication, and the professional presence to represent Fortellar credibly in front of client technical staff and executives, both in person and virtually.\n\nMust be able to travel 10% - 20% to client sites\n\nIdentity and Privileged Access Engineering\n\nDesign and enforce phishing-resistant multifactor authentication for administrators and multifactor authentication for the full user population, using modern authentication methods (e.g., FIDO2 security keys, Windows Hello for Business, passkeys).\n\nReduce privileged directory role membership to a justified minimum, remove dormant and stale accounts from sensitive groups, and produce the privileged-overlap map between Microsoft Entra ID and on-premises Active Directory.\n\nRemediate domain-dominance exposure, including krbtgt account rotation, removal of delegation from privileged accounts, and migration of the directory synchronization connector onto a dedicated least-privilege identity.\n\nRedesign Conditional Access around defined user and administrator personas and apply role-based access control, recognizing that this design is a prerequisite for device trust enforcement elsewhere in the program.\n\nImplement Privileged Identity Management with just-in-time elevation, and enforce sign-in frequency and non-persistent administrator sessions.\n\nEvaluate, select, deploy, and operate privileged access management and identity governance capability, and establish quarterly access recertification as a sustainable business-as-usual process.\n\nVulnerability, Endpoint, and Asset Management\n\nRemediate, as emergency change, the recommendations carrying published exploit code and observed exploitation in the wild, working within the client's emergency change authority.\n\nAuthor and publish a vulnerability management procedure and a workstation patch service level matching the standard already operating for servers.\n\nDeploy Windows Autopatch and Microsoft Intune update rings, and reconcile the Active Directory, Intune, and Defender device populations into a single authoritative asset inventory.\n\nComplete application dependency mapping, then retire legacy authentication protocols and enforce LDAP server signing and channel binding, sequencing the work so that dependency discovery precedes enforcement.\n\nDeploy security baselines in staged waves across the managed endpoint estate and remove or formally risk-accept end-of-support systems and software.\n\nClose local administrator credential management gaps across the estate and operate certificate lifecycle management with expiry alerting and unauthorized-software detection.\n\nReview exposure score, remediation activity, and threat intelligence on a defined cadence, prioritizing by exploit availability and observed threat activity rather than by severity score alone.\n\nDevice Trust and Mobile Device Management\n\nEnforce the client's ratified bring-your-own-device position, including restriction of corporate content synchronization to managed devices.\n\nDeploy Microsoft Intune application protection policies across the Microsoft 365 mobile applications and execute the mobile application and device management plan across a previously unmanaged mobile estate.\n\nHarden connected software-as-a-service applications, including multifactor authentication enforcement and session timeout configuration.\n\nRequire a compliant or hybrid-joined device through Conditional Access, enable remote wipe for devices holding organizational data, and apply session controls for unmanaged browsers.\n\nEstablish the device attestation cycle within joiner, mover, and leaver processes, and report on unmanaged access attempts on a defined cadence.\n\nChange Management and Operational Safety\n\nDesign and operate pilot rings and staged rollouts for every change capable of denying user or administrator access, with documented rollback and tested break-glass accounts.\n\nPrepare, submit, and present change records to the client's change process, including risk, blast radius, validation steps, and backout plan.\n\nExecute change during scheduled maintenance windows, including evenings and weekends where the change cannot safely be made during business hours.\n\nHalt or defer a rollout where validation is incomplete and communicate that decision and its schedule consequence to the engagement lead and the client without delay.\n\nExperience and Education\n\nBachelor’s degree in Computer Science, Information Security or a related field\n\nPreferred certifications: SC-300, MD-102, AZ-500, SC-100 or CISSP\n\n8+ years in infrastructure or security engineering, including 5+ years in hybrid identity (Entra ID and on-premises AD)\n\n4+ years deploying Microsoft Intune and Defender for Endpoint at enterprise scale\n\nProven experience designing Conditional Access, phishing-resistant MFA and Privileged Identity Management for 1,000+ users\n\n3+ years in a client-facing consulting role, presenting to technical and executive stakeholders\n\nTrack record of leading high-risk changes through formal change management, using pilots, staged rollouts and rollback plans\n\nThis role is open only to candidates who currently live and are authorized to work in the United States. Applications must be submitted from within the U.S. Applications submitted from a location that does not match the candidate’s stated location will not be considered.\n\nOriginally posted on Himalayas","description_format":"text","description_chars":7661,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation"],"lifecycle":[{"event":"open","at":"2026-11-06T14:28:45Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":30,"reasons":["seen:1","win:early"],"computed_at":"2026-11-08T05:47:12Z"},"pay":{"stated_usd_annual":155000,"is_top_pay":false},"html_url":"https://alion.io/job/fortellar-remote-sr-security-engineer-identity-endpoint","json_url":"https://alion.io/job/fortellar-remote-sr-security-engineer-identity-endpoint.json","meta":{"generated_at":"2026-11-08T15:57:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"assistant_verified","counted_by":"address","units_charged":1,"used_today":5723,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":676107},"rest":"https://alion.io/mcp/rest/get_company?id=676107"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffortellar-remote-sr-security-engineer-identity-endpoint"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffortellar-remote-sr-security-engineer-identity-endpoint"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffortellar-remote-sr-security-engineer-identity-endpoint"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/fortellar-remote-sr-security-engineer-identity-endpoint\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffortellar-remote-sr-security-engineer-identity-endpoint"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3871567}},{"tool":"search_jobs","arguments":{"company":"fortellar.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3871567},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}